diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 49ec5eeb8..2068964cd 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,8 +1,11 @@
 # Require admin approval for GitHub settings and workflow modifications
 /.github/  @usdigitalresponse/grants-admins
 
-# Require admin approval for Terraform IAC modifications
-/terraform/ @usdigitalresponse/grants-admins
-
 # Require admin approval when Postgres root CA bundle is modified
 /packages/server/rds-combined-ca-bundle.pem @usdigitalresponse/grants-admins
+
+# Require admin approval for special doc modifications
+README.md  @usdigitalresponse/grants-admins
+LICENSE  @usdigitalresponse/grants-admins
+CODE_OF_CONDUCT.md  @usdigitalresponse/grants-admins
+CONTRIBUTING.md @usdigitalresponse/grants-admins
diff --git a/.github/next_release_version.bash b/.github/next_release_version.bash
new file mode 100755
index 000000000..f6a8d1e48
--- /dev/null
+++ b/.github/next_release_version.bash
@@ -0,0 +1,53 @@
+#! /bin/bash
+
+# Defaults
+next_version_release_year=$(TZ='UTC' date '+%Y')
+next_version_release_number=1
+
+if [[ $1 == 'test' ]]; then
+    echo 'Running tests...' >&2
+    dotest() {
+        result=$(bash $0 "release/${1}" 2> /dev/null | tail -n 1)
+        expect="${2}"
+        if [[ $result != $expect ]]; then
+            printf "Test failed:\n  Expected: $expect\n  Received: $result\n" >&2
+            exit 1
+        fi
+    }
+    dotest 'release/1234.987' "$next_version_release_year.1"
+    dotest 'release/0.0' "$next_version_release_year.1"
+    dotest 'release/0' "$next_version_release_year.1"
+    dotest 'sometag' "$next_version_release_year.1"
+    dotest "release/$next_version_release_year.1" "$next_version_release_year.2"
+    dotest "release/$next_version_release_year.19" "$next_version_release_year.20"
+    dotest "release/$next_version_release_year.399" "$next_version_release_year.400"
+    echo 'Tests complete' >&2
+    exit 0
+fi
+
+if [[ -z $1 ]]; then
+    # Ensure tag history is available
+    git fetch --prune --unshallow
+    tag=$(git describe --tags --match='release/[0-9][0-9][0-9][0-9].[0-9]*' refs/heads/main)
+else
+    tag=$1
+fi
+
+regex='release\/([0-9]{4})\.([0-9]+)'
+if [[ $tag =~ $regex ]]; then
+    echo "Found tag for previous release: $tag" >&2
+    prev_version_release_number="${BASH_REMATCH[2]}"
+    echo "Previous version number: $prev_version_release_number" >&2
+    if [[ $next_version_release_year == "${BASH_REMATCH[1]}" ]]; then
+        ((next_version_release_number=prev_version_release_number+1))
+    else
+        echo "Ignoring previous version number because it pertains to a different year" >&2
+    fi
+else
+    echo "Could not locate a previous release version" >&2
+fi
+
+next_version="$next_version_release_year.$next_version_release_number"
+echo "Next version: $next_version" >&2
+# Output result to stdout
+printf "$next_version"
diff --git a/.github/release-drafter.yml b/.github/release-drafter.yml
new file mode 100644
index 000000000..aae1a99ce
--- /dev/null
+++ b/.github/release-drafter.yml
@@ -0,0 +1,133 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/release-drafter/release-drafter/master/schema.json
+name-template: 'v$RESOLVED_VERSION'
+tag-template: 'release/$RESOLVED_VERSION'
+tag-prefix: 'release/'
+version-template: '2023.$MINOR'
+version-resolver:
+  default: minor
+prerelease: true
+categories:
+  - title: 🚀 New features and enhancements
+    collapse-after: 10
+    labels:
+      - enhancement
+  - title: 🐛 Bug fixes
+    collapse-after: 10
+    labels:
+      - bug
+  - title: 📖 Documentation improvements
+    collapse-after: 10
+    labels:
+      - documentation
+  - title: 🔧 Dependency updates
+    collapse-after: 3
+    labels:
+      - dependencies
+  - title: 🔍 Federal Grant Finder updates
+    collapse-after: 3
+    labels:
+      - Grant Finder
+  - title: 🧾 ARPA Reporter updates
+    collapse-after: 3
+    labels:
+      - arpa validations
+      - arpa subrecipients
+      - arpa web tool
+      - arpa audit report
+      - arpa output templates
+      - arpa quarterly reporter
+      - performance reporter
+  - title: Other changes
+    labels:
+      - '*'
+category-template: '### $TITLE'
+exclude-labels:
+  - skip-changelog
+exclude-contributors:
+  - dependabot
+  - 'dependabot[bot]'
+  - step-security-bot
+autolabeler:
+  - label: javascript
+    files:
+      - '**/*.js'
+      - '**/package.json'
+      - 'packages/**'
+      - '**/yarn.lock'
+      - '**/.npmrc'
+      - '**/.nvmrc'
+      - '**/.nycrc'
+      - '**/.node-version'
+      - '**/.huskyrc.json'
+      - '**/lerna.json'
+      - '**/eslintrc.js'
+      - '**/.browserslistrc'
+  - label: database-changes
+    files:
+      - 'packages/server/migrations/**'
+      - 'packages/server/knexfile.js'
+      - 'packages/server/rds-combined-ca-bundle.pem'
+  - label: terraform
+    files:
+      - 'terraform/**'
+  - label: Infra
+    files:
+      - 'terraform/**'
+      - 'docker/**'
+      - '**/docker-compose.yml'
+      - '**/docker-compose.yaml'
+      - 'localstack/**'
+  - label: dependencies
+    files:
+      - '**/yarn.lock'
+      - '**/.terraform.lock.hcl'
+    branch:
+      - '/^dependabot\/.+$/i'
+  - label: documentation
+    files:
+      - README
+      - '**/doc/**'
+      - '**/docs/**'
+      - '**/*.md'
+      - .adr-dir
+    branch:
+      - '/^docs?\/.+$/'
+  - label: bug
+    branch:
+      - '/^fix\/.+$/i'
+      - '/^bug\/.+$/i'
+    title:
+      - '/\bfix(es)?\b/i'
+      - '/\bbug\b/i'
+      - '/\brevert(s)?\b/i'
+  - label: enhancement
+    branch:
+      - '/^feat(ures?)?\/.+$/i'
+      - '/^enhance(s|ments?)?\/.+$/i'
+    title:
+      - '/\b(?<!^chores?\b.*)feat(ures?)?\b/i'
+      - '/\b(?<!^chores?\b.*)enhance(s|ment)?\b/i'
+  - label: github
+    files:
+      - '.github/**'
+      - '**/.gitignore'
+change-template: '- $TITLE @$AUTHOR (#$NUMBER)'
+change-title-escapes: '\<*_&'
+no-contributors-template: >-
+  '*All changes in this release were crafted by robots (and reviewed by humans).*'
+template: |
+  ## 📚 Summary
+
+  The releaser should provide a high-level summary here (or remove this section).
+
+  ## 🛠️ Changes
+
+  $CHANGES
+
+  ## 🤝 Contributors
+
+  We would like to thank the following people who made this release possible:
+
+  $CONTRIBUTORS
+
+  ## Deployment History
diff --git a/.github/release.yml b/.github/release.yml
new file mode 100644
index 000000000..98688b994
--- /dev/null
+++ b/.github/release.yml
@@ -0,0 +1,20 @@
+changelog:
+  exclude:
+    labels:
+      - skip-changelog
+  categories:
+    - title: 🚀 New features and enhancements
+      labels:
+        - enhancement
+    - title: 🐛 Bug fixes
+      labels:
+        - bug
+    - title: 📖 Documentation improvements
+      labels:
+        - documentation
+    - title: 🔧 Dependency updates
+      labels:
+        - dependencies
+    - title: Other Changes
+      labels:
+        - "*"
diff --git a/.github/workflows/aws-auth.yml b/.github/workflows/aws-auth.yml
new file mode 100644
index 000000000..03d6221c4
--- /dev/null
+++ b/.github/workflows/aws-auth.yml
@@ -0,0 +1,69 @@
+name: Configure AWS Credentials
+
+on:
+  workflow_call:
+    inputs:
+      aws-region:
+        type: string
+        required: true
+    secrets:
+      role-to-assume:
+        required: true
+      gpg-passphrase:
+        required: true
+    outputs:
+      aws-access-key-id:
+        value: ${{ jobs.oidc-auth.outputs.aws-access-key-id }}
+      aws-secret-access-key:
+        value: ${{ jobs.oidc-auth.outputs.aws-secret-access-key }}
+      aws-session-token:
+        value: ${{ jobs.oidc-auth.outputs.aws-session-token }}
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  oidc-auth:
+    name: OIDC Auth
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    outputs:
+      aws-access-key-id: ${{ steps.encrypt-aws-access-key-id.outputs.out }}
+      aws-secret-access-key: ${{ steps.encrypt-aws-secret-access-key.outputs.out }}
+      aws-session-token: ${{ steps.encrypt-aws-session-token.outputs.out }}
+    steps:
+      - uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        with:
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            sts.us-west-2.amazonaws.com:443
+      - id: auth
+        uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4.0.1
+        with:
+          aws-region: us-west-2
+          role-to-assume: "${{ secrets.role-to-assume }}"
+      - name: Encrypt aws-access-key-id
+        id: encrypt-aws-access-key-id
+        run: |
+          encrypted=$(gpg --batch --yes --passphrase "$GPG_PASSPHRASE" -c --cipher-algo AES256 -o - <(echo "$AWS_ACCESS_KEY_ID") | base64 -w0)
+          echo "out=$encrypted" >> $GITHUB_OUTPUT
+        env:
+          GPG_PASSPHRASE: ${{ secrets.gpg-passphrase }}
+      - name: Encrypt aws-secret-access-key
+        id: encrypt-aws-secret-access-key
+        run: |
+          encrypted=$(gpg --batch --yes --passphrase "$GPG_PASSPHRASE" -c --cipher-algo AES256 -o - <(echo "$AWS_SECRET_ACCESS_KEY") | base64 -w0)
+          echo "out=$encrypted" >> $GITHUB_OUTPUT
+        env:
+          GPG_PASSPHRASE: ${{ secrets.gpg-passphrase }}
+      - name: Encrypt aws-session-token
+        id: encrypt-aws-session-token
+        run: |
+          encrypted=$(gpg --batch --yes --passphrase "$GPG_PASSPHRASE" -c --cipher-algo AES256 -o - <(echo "$AWS_SESSION_TOKEN") | base64 -w0)
+          echo "out=$encrypted" >> $GITHUB_OUTPUT
+        env:
+          GPG_PASSPHRASE: ${{ secrets.gpg-passphrase }}
diff --git a/.github/workflows/build-and-deploy.yml b/.github/workflows/build-and-deploy.yml
deleted file mode 100644
index e7625212d..000000000
--- a/.github/workflows/build-and-deploy.yml
+++ /dev/null
@@ -1,216 +0,0 @@
-name: Build and deploy GOST
-
-on:
-  push:
-    branches:
-      - _staging
-      - main
-
-concurrency:
-  group: ${{ github.workflow_ref }}
-
-permissions:
-  contents: read
-  id-token: write
-  packages: write
-
-jobs:
-  changes:
-    name: Detect changes
-    runs-on: ubuntu-latest
-    outputs:
-      api: ${{ steps.filter.outputs.api }}
-      website: ${{ steps.filter.outputs.website }}
-      terraform: ${{ steps.filter.outputs.terraform }}
-    steps:
-      - uses: actions/checkout@v3
-      - uses: dorny/paths-filter@v2
-        id: filter
-        with:
-          base: ${{ github.ref }}
-          filters: |
-            api:
-              - ".github/workflows/build-api.yml"
-              - '.github/workflows/build-and-deploy.yml'
-              - 'packages/server/**'
-              - 'docker/production-api.Dockerfile'
-              - '.nvmrc'
-              - 'yarn.lock'
-            website:
-              - ".github/workflows/build-website.yml"
-              - '.github/workflows/build-and-deploy.yml'
-              - 'packages/client/**'
-              - '.node-version'
-              - '.nvmrc'
-              - 'yarn.lock'
-            terraform:
-              - 'terraform/**'
-
-  build_api:
-    name: Build and push GOST API Docker image
-    needs:
-      - changes
-    if: needs.changes.outputs.api == 'true'
-    uses: "./.github/workflows/build-api.yml"
-    permissions:
-      contents: read
-      packages: write
-
-  build_website:
-    name: Build website deployment artifact
-    needs:
-      - changes
-    if: needs.changes.outputs.website == 'true'
-    uses: "./.github/workflows/build-website.yml"
-    permissions:
-      contents: read
-
-  select_target_environment:
-    name: Select target environment
-    uses: "./.github/workflows/select-target-environment.yml"
-    with:
-      ref_name: "${{ github.ref_name }}"
-
-  deploy_terraform:
-    name: Deploy terraform
-    runs-on: ubuntu-latest
-    needs:
-      - select_target_environment
-      - changes
-    if: needs.changes.outputs.terraform == 'true'
-    concurrency:
-      group: run_terraform-${{ needs.select_target_environment.outputs.selected }}
-      cancel-in-progress: false
-    environment: ${{ needs.select_target_environment.outputs.selected }}
-    env:
-      TF_PLUGIN_CACHE_DIR: ~/.terraform.d/plugin-cache
-      TF_VAR_version_identifier: ${{ github.sha }}
-      TF_VAR_datadog_api_key: ${{ secrets.DATADOG_API_KEY }}
-      TF_VAR_datadog_app_key: ${{ secrets.DATADOG_APP_KEY }}
-    steps:
-      - uses: actions/checkout@v3
-      - name: Get project TF version
-        id: get_version
-        run: echo "TF_VERSION=$(cat .terraform-version | tr -d '[:space:]')" | tee -a $GITHUB_OUTPUT
-        working-directory: terraform
-      - uses: hashicorp/setup-terraform@v2
-        with:
-          terraform_version: ${{ steps.get_version.outputs.TF_VERSION }}
-      - name: Ensure Terraform plugin cache exists
-        run: mkdir -p $TF_PLUGIN_CACHE_DIR
-      - name: Save/Restore Terraform plugin cache
-        uses: actions/cache@v3
-        with:
-          path: ${{ env.TF_PLUGIN_CACHE_DIR }}
-          key: ${{ runner.os }}-terraform-${{ hashFiles('**/.terraform.lock.hcl') }}
-          restore-keys: |
-            ${{ runner.os }}-terraform-
-      - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v1
-        with:
-          aws-region: us-west-2
-          role-to-assume: "${{ secrets.AWS_ROLE_TO_ASSUME }}"
-      - name: Terraform Init
-        id: init
-        run: terraform init -backend-config="${{ needs.select_target_environment.outputs.selected }}.s3.tfbackend"
-        working-directory: terraform
-      - name: Terraform Validate
-        id: validate
-        run: terraform validate -no-color
-        working-directory: terraform
-      - name: Terraform Apply
-        if: steps.validate.outcome == 'success'
-        id: apply
-        run: terraform apply -auto-approve -input=false -no-color -var-file="${{ needs.select_target_environment.outputs.selected }}.tfvars"
-        working-directory: terraform
-
-  deploy_website:
-    name: Deploy website
-    runs-on: ubuntu-latest
-    needs:
-      - build_website
-      - select_target_environment
-      - deploy_terraform
-    if: |
-      always() &&
-      needs.build_website.result == 'success' &&
-      (needs.deploy_terraform.result == 'success' || needs.deploy_terraform.result == 'skipped')
-    environment: ${{ needs.select_target_environment.outputs.selected }}
-    steps:
-      - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v1
-        with:
-          aws-region: us-west-2
-          role-to-assume: "${{ secrets.AWS_ROLE_TO_ASSUME }}"
-      - name: Get deployment parameters
-        uses: dkershner6/aws-ssm-getparameters-action@v1
-        with:
-          withDecryption: "true"
-          parameterPairs: |
-            /gost/${{ needs.select_target_environment.outputs.selected }}/deploy-config/website/s3-uri = S3_DEPLOYMENT_URI,
-            /gost/${{ needs.select_target_environment.outputs.selected }}/deploy-config/website/distribution-id = CLOUDFRONT_DISTRIBUTION_ID
-      - name: Download build
-        uses: actions/download-artifact@v3
-        with:
-          name: ${{ needs.build_website.outputs.artifact }}
-          path: dist
-      - name: Upload artifact to S3
-        run: aws s3 sync ./dist ${{ env.S3_DEPLOYMENT_URI }} --sse --delete --no-progress
-      - name: Invalidate CloudFront cache
-        run: aws cloudfront create-invalidation --paths "/*" --distribution-id ${{ env.CLOUDFRONT_DISTRIBUTION_ID }}
-
-  deploy_api:
-    name: Deploy API
-    runs-on: ubuntu-latest
-    needs:
-      - build_api
-      - select_target_environment
-      - deploy_terraform
-    if: |
-      always() &&
-      needs.build_api.result == 'success' &&
-      (needs.deploy_terraform.result == 'success' || needs.deploy_terraform.result == 'skipped')
-    environment: ${{ needs.select_target_environment.outputs.selected }}
-    steps:
-      - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v1
-        with:
-          aws-region: us-west-2
-          role-to-assume: "${{ secrets.AWS_ROLE_TO_ASSUME }}"
-      - name: Get deployment parameters
-        uses: dkershner6/aws-ssm-getparameters-action@v1
-        with:
-          withDecryption: "true"
-          parameterPairs: |
-            /gost/${{ needs.select_target_environment.outputs.selected }}/deploy-config/api/cluster-name = ECS_CLUSTER_NAME,
-            /gost/${{ needs.select_target_environment.outputs.selected }}/deploy-config/api/service-name = ECS_SERVICE_NAME
-      - name: Update ECS service
-        run: aws ecs update-service --cluster ${{ env.ECS_CLUSTER_NAME }} --service ${{ env.ECS_SERVICE_NAME }} --force-new-deployment > /dev/null
-
-  deploy_grants_consumer:
-    name: Deploy Grants Consumer
-    runs-on: ubuntu-latest
-    needs:
-      - build_api
-      - select_target_environment
-      - deploy_terraform
-    if: |
-      always() &&
-      needs.build_api.result == 'success' &&
-      (needs.deploy_terraform.result == 'success' || needs.deploy_terraform.result == 'skipped')
-    environment: ${{ needs.select_target_environment.outputs.selected }}
-    steps:
-      - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v1
-        with:
-          aws-region: us-west-2
-          role-to-assume: "${{ secrets.AWS_ROLE_TO_ASSUME }}"
-      - name: Get deployment parameters
-        uses: dkershner6/aws-ssm-getparameters-action@v1
-        with:
-          withDecryption: "true"
-          parameterPairs: |
-            /gost/${{ needs.select_target_environment.outputs.selected }}/deploy-config/consume-grants/cluster-name = ECS_CLUSTER_NAME,
-            /gost/${{ needs.select_target_environment.outputs.selected }}/deploy-config/consume-grants/service-name = ECS_SERVICE_NAME
-      - name: Update ECS service
-        run: aws ecs update-service --cluster ${{ env.ECS_CLUSTER_NAME }} --service ${{ env.ECS_SERVICE_NAME }} --force-new-deployment > /dev/null
diff --git a/.github/workflows/build-api.yml b/.github/workflows/build-api.yml
deleted file mode 100644
index 1deccefab..000000000
--- a/.github/workflows/build-api.yml
+++ /dev/null
@@ -1,64 +0,0 @@
-name: Build Docker image for GOST API
-
-on:
-  pull_request:
-    paths:
-      - ".github/workflows/build-api.yml"
-      - "packages/server/**"
-      - "docker/production-api.Dockerfile"
-      - "yarn.lock"
-  workflow_call: {}
-
-permissions:
-  contents: read
-  packages: write
-
-env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository }}-api
-
-jobs:
-  build-and-push:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-      - name: Authenticate docker
-        uses: docker/login-action@v2
-        with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Set date/time-based version string as env var
-        run: echo "DATETIME_VERSION=$(TZ=UTC date +'%Y%m%d.%H%M')" >> $GITHUB_ENV
-      - name: Extract metadata for Docker
-        id: meta
-        uses: docker/metadata-action@v4
-        with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: |
-            type=sha,enable=true,priority=100,prefix=,suffix=,format=short
-            type=raw,enable=true,priority=200,prefix=,suffix=,value=${{ env.DATETIME_VERSION }}
-            type=raw,enable=${{ github.event_name != 'pull_request' }},priority=300,value=latest
-            type=raw,enable=${{ github.ref == 'refs/heads/main' }},priority=300,value=stable
-          labels: |
-            org.opencontainers.image.title=${{ env.IMAGE_NAME }}
-            org.opencontainers.image.version=${{ env.DATETIME_VERSION }}
-            com.datadoghq.tags.service=gost
-            com.datadoghq.tags.version=${{ github.sha }}
-      - name: Build and push Docker image
-        uses: docker/build-push-action@v3
-        with:
-          context: .
-          push: ${{ github.event_name != 'pull_request' }}
-          file: docker/production-api.Dockerfile
-          tags: ${{ steps.meta.outputs.tags }}
-          platforms: linux/amd64,linux/arm64
-          labels: ${{ steps.meta.outputs.labels }}
-          build-args: |
-            GIT_COMMIT=${{ github.sha }}
-            GIT_REF=${{ github.ref }}
-            TIMESTAMP=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}
diff --git a/.github/workflows/build-website.yml b/.github/workflows/build-website.yml
deleted file mode 100644
index c637231a4..000000000
--- a/.github/workflows/build-website.yml
+++ /dev/null
@@ -1,52 +0,0 @@
-name: Build GOST Website
-
-on:
-  pull_request:
-    paths:
-      - ".github/workflows/build-website.yml"
-      - "packages/client/**"
-      - ".node-version"
-      - ".nvmrc"
-      - "yarn.lock"
-  workflow_call:
-    outputs:
-      artifact:
-        description: "Identifier for the website build artifact"
-        value: ${{ jobs.build.outputs.artifact }}
-
-concurrency:
-  group: build-website-${{ github.workflow_ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    name: Build website deployment artifact
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    outputs:
-      artifact: website-${{ github.sha }}
-    env:
-      BUILD_DIR: packages/client
-    steps:
-      - uses: actions/checkout@v3
-      - name: Install Node.js
-        uses: actions/setup-node@v2
-        with:
-          node-version-file: '.nvmrc'
-          cache: yarn
-      - name: Install dependencies
-        working-directory: ${{ env.BUILD_DIR }}
-        run: yarn install --frozen-lockfile
-      - name: Build the website
-        working-directory: ${{ env.BUILD_DIR }}
-        run: yarn build
-      - name: Upload build artifact
-        # if: ${{ github.event_name != 'pull_request' }}
-        uses: actions/upload-artifact@v3
-        with:
-          name: website-${{ github.sha }}
-          path: ${{ env.BUILD_DIR }}/dist
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 000000000..5760bc8b1
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,283 @@
+name: Build
+
+permissions:
+  contents: read
+  packages: write
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        type: string
+        required: true
+      build-server-image:
+        description: Whether to build a `usdr-gost-api` Docker image using the `production-api.Dockerfile`.
+        type: boolean
+        default: true
+      build-website:
+        description: Whether to build website distribution artifacts for the client package.
+        type: boolean
+        default: true
+      server-image-args-ref:
+        description: Ref name for the build commit, like refs/heads/my-feature-branch-1.
+        type: string
+        required: true
+      server-image-artifacts-retention-days:
+        description: Number of days to store Docker attestation artifacts.
+        type: number
+        default: 90
+      server-image-upload-attestations:
+        description: Whether to upload attestation files for the Docker build as artifacts.
+        type: boolean
+        default: false
+      server-image-push:
+        description: Whether to push Docker images to the registry after building.
+        type: boolean
+        default: true
+      server-image-name:
+        description: Name of the docker image. Use caution when setting a non-default value.
+        type: string
+        default: ${{ github.repository }}-api
+      server-image-registry:
+        description: The Docker image registry. Use caution when setting a non-default value.
+        type: string
+        default: ghcr.io
+      server-image-tag-latest:
+        description: Tags image builds with `latest`.
+        type: boolean
+        default: false
+      server-image-tag-production:
+        description: Tags image builds with `production`.
+        type: boolean
+        required: false
+      server-image-tag-pr:
+        description: A PR number to add as a Docker image tag (as `pr-<value>`) when building for a pull request.
+        type: string
+        required: false
+      server-image-tag-release:
+        description: A tag value that, if provided, signifies the release version associated with the Docker image.
+        type: string
+        required: false
+      server-image-version:
+        description: Value to set for the `org.opencontainers.image.version label`.
+        type: string
+        default: ""
+      website-artifact-retention-days:
+        description: Number of days to retain website build artifacts.
+        type: number
+        default: 90
+    outputs:
+      build-server-image-result:
+        value: ${{ jobs.server-docker-image.result }}
+      build-website-result:
+        value: ${{ jobs.website-bundle.result }}
+      server-image-digest:
+        value: ${{ jobs.server-docker-image.outputs.digest }}
+      server-attestation-artifacts-key:
+        value: ${{ jobs.server-docker-image.outputs.attestation-artifacts-key }}
+      server-attestation-artifacts-path:
+        value: ${{ jobs.server-docker-image.outputs.attestation-artifacts-path }}
+      website-artifacts-key:
+        value: ${{ jobs.website-bundle.outputs.artifacts-key }}
+      website-artifacts-path:
+        value: ${{ jobs.website-bundle.outputs.artifacts-path }}
+      website-checksums-sha256:
+        value: ${{ jobs.website-bundle.outputs.checksums-sha256 }}
+
+jobs:
+  server-docker-image:
+    name: Build server Docker image
+    if: inputs.build-server-image
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    env:
+      ATTESTATION_ARTIFACTS_KEY: "server-image-attestations-${{ inputs.ref }}"
+    outputs:
+      commit-tag: ${{ inputs.ref }}
+      digest: ${{ steps.build-push.outputs.digest }}
+      attestation-artifacts-key: ${{ env.ATTESTATION_ARTIFACTS_KEY }}
+      attestation-artifacts-path: ${{ steps.store-attestations.outputs.path }}
+    steps:
+      - uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        with:
+          disable-sudo: true
+          egress-policy: audit
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        id: checkout
+        with:
+          ref: ${{ inputs.ref }}
+          show-progress: 'false'
+          persist-credentials: 'false'
+      - name: Set build info for the checked-out commit
+        id: commit-sha
+        run: echo "long=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
+        with:
+          platforms: linux/amd64,linux/arm64
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
+        with:
+          platforms: linux/amd64,linux/arm64
+      - name: Authenticate docker
+        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Extract metadata for Docker
+        id: meta
+        uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
+        with:
+          images: ${{ inputs.server-image-registry }}/${{ inputs.server-image-name }}
+          tags: |
+            type=raw,enable=true,priority=100,prefix=sha-,value=${{ steps.commit-sha.outputs.long }}
+            type=raw,enable=${{ inputs.server-image-tag-release != '' }},priority=200,value=${{ inputs.server-image-tag-release }}
+            type=raw,enable=${{ inputs.server-image-tag-latest }},priority=300,value=latest
+            type=raw,enable=${{ inputs.server-image-tag-pr != '' }},priority=600,prefix=pr-,value=${{ inputs.server-image-tag-pr }}
+          labels: |
+            org.opencontainers.image.title=${{ inputs.server-image-name }}
+            org.opencontainers.image.version=${{ inputs.server-image-version }}
+            org.opencontainers.image.revision=${{ steps.commit-sha.outputs.long }}
+            com.datadoghq.tags.service=gost
+            com.datadoghq.tags.version=${{ steps.commit-sha.outputs.long }}
+      - name: Set bake file definition as step output
+        id: bakefile
+        run: |
+          BAKEFILE_CONTENTS="$(cat $BAKEFILE_PATH)"
+          echo "result<<ENDOFBAKEFILE" >> $GITHUB_OUTPUT
+          echo "$BAKEFILE_CONTENTS" >> $GITHUB_OUTPUT
+          echo "ENDOFBAKEFILE" >> $GITHUB_OUTPUT
+        env:
+          BAKEFILE_PATH: ${{ steps.meta.outputs.bake-file }}
+      - name: Build and push Docker image
+        id: build-push
+        uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0
+        with:
+          context: .
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          push: ${{ inputs.server-image-push }}
+          file: docker/production-api.Dockerfile
+          platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          provenance: true
+          sbom: true
+          build-args: |
+            GIT_COMMIT=${{ inputs.ref }}
+            GIT_REF=${{ inputs.server-image-args-ref }}
+            TIMESTAMP=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.created'] }}
+      - name: Publish build results
+        run: |
+          REPORT_FILE=$(mktemp -t summary.md.XXXXX)
+          cat >> $REPORT_FILE << 'ENDOFREPORT'
+          ## Docker Build Summary
+
+          **Image ID:** `${{ steps.build-push.outputs.imageid }}`
+          **Image Digest:** `${{ steps.build-push.outputs.digest }}`
+
+          <details>
+          <summary>Bake File</summary>
+
+          ```json
+          ${{ steps.bakefile.outputs.result }}
+          ```
+
+          </details>
+          <details>
+          <summary>Build Metadata</summary>
+
+          ```json
+          ${{ steps.build-push.outputs.metadata }}
+          ```
+
+          </details>
+          ENDOFREPORT
+          cat "$REPORT_FILE" >> $GITHUB_STEP_SUMMARY
+      - name: Store attestations
+        id: store-attestations
+        if: inputs.server-image-upload-attestations
+        run: |
+          ATTESTATIONS_DIR=$(mktemp -d)
+          echo "path=$ATTESTATIONS_DIR" >> $GITHUB_OUTPUT
+          docker buildx imagetools inspect "$INSPECT_NAME" --format "{{ json .SBOM }}" > $ATTESTATIONS_DIR/sbom.sdpx.json
+          docker buildx imagetools inspect "$INSPECT_NAME" --format "{{ json .Provenance }}" > $ATTESTATIONS_DIR/provenance.json
+        env:
+          INSPECT_NAME: ${{ inputs.server-image-registry }}/${{ inputs.server-image-name }}@${{ steps.build-push.outputs.digest }}
+      - name: Upload attestations
+        if: steps.store-attestations.outcome == 'success'
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        with:
+          name: ${{ env.ATTESTATION_ARTIFACTS_KEY }}
+          path: ${{ steps.store-attestations.outputs.path }}
+          if-no-files-found: error
+          retention-days: ${{ inputs.server-image-artifacts-retention-days }}
+
+  website-bundle:
+    name: Build website deployment artifact
+    if: inputs.build-website
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: none
+    env:
+      ARTIFACTS_KEY: website-${{ inputs.ref }}
+      ARTIFACTS_PATH: ${{ github.workspace }}/packages/client/dist
+    outputs:
+      artifacts-key: ${{ env.ARTIFACTS_KEY }}
+      artifacts-path: ${{ env.ARTIFACTS_PATH }}
+      checksums-sha256: ${{ steps.checksums.outputs.sha256 }}
+    steps:
+      - uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        with:
+          disable-sudo: true
+          egress-policy: audit
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          ref: ${{ inputs.ref }}
+          show-progress: 'false'
+          persist-credentials: 'false'
+      - name: Setup Node
+        uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
+        with:
+          node-version-file: .nvmrc
+          cache: yarn
+          cache-dependency-path: yarn.lock
+      - name: Install dependencies
+        run: yarn workspace client install --frozen-lockfile
+      - name: Build the website
+        run: yarn workspace client build
+      - name: Compute build artifact checksums
+        id: checksums
+        run: |
+          DIST_CHECKSUMS=$(find "$ARTIFACTS_PATH" -type f -exec sha256sum {} \;)
+          echo "sha256<<EOF" >> $GITHUB_OUTPUT
+          echo "$DIST_CHECKSUMS" >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+      - name: Publish build results
+        run: |
+          REPORT_FILE=$(mktemp -t summary.md.XXXXX)
+          cat >> $REPORT_FILE << 'ENDOFREPORT'
+          ## Build Website Summary
+
+          <details>
+          <summary>Checksums</summary>
+
+          ```
+          ${{ steps.checksums.outputs.sha256 }}
+          ```
+
+          </details>
+          ENDOFREPORT
+          cat "$REPORT_FILE" >> $GITHUB_STEP_SUMMARY
+      - name: Upload build artifact
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        with:
+          name: ${{ env.ARTIFACTS_KEY }}
+          path: ${{ env.ARTIFACTS_PATH }}
+          if-no-files-found: error
+          retention-days: ${{ inputs.website-artifact-retention-days }}
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
deleted file mode 100644
index 2bef50450..000000000
--- a/.github/workflows/ci.yaml
+++ /dev/null
@@ -1,117 +0,0 @@
-name: Continuous Integration
-
-on:
-  pull_request: {}
-  push:
-    branches:
-      - main
-    paths-ignore:
-      - "docs/**"
-
-jobs:
-  test-e2e-integration:
-    name: "Cypress Integration Tests"
-    runs-on: ubuntu-latest
-    services:
-      postgres:
-        image: "postgres:13"
-        env:
-          POSTGRES_DB: usdr_grants_test
-          POSTGRES_USER: postgres
-          POSTGRES_PASSWORD: password
-        ports:
-          - 5432:5432
-        # Set health checks to wait until postgres has started
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-
-    steps:
-      - uses: actions/checkout@v2
-      - name: Install Node.js
-        uses: actions/setup-node@v2
-        with:
-          node-version: 16.14.0
-          cache: yarn
-      - name: Install dependencies
-        run: yarn setup
-      - name: Run migrations
-        env:
-          POSTGRES_TEST_URL: "postgresql://postgres:password@localhost:${{ job.services.postgres.ports[5432] }}/usdr_grants_test"
-          # This is intentional to set POSTGRES_URL=POSTGRES_TEST_URL; ARPA Reporter test runner gates
-          # dev vs. CI differences based on whether these are the same.
-          POSTGRES_URL: "postgresql://postgres:password@localhost:${{ job.services.postgres.ports[5432] }}/usdr_grants_test"
-        run: yarn db:migrate
-      - name: Start Applications
-        env:
-          POSTGRES_TEST_URL: "postgresql://postgres:password@localhost:${{ job.services.postgres.ports[5432] }}/usdr_grants_test"
-          # This is intentional to set POSTGRES_URL=POSTGRES_TEST_URL; ARPA Reporter test runner gates
-          # dev vs. CI differences based on whether these are the same.
-          POSTGRES_URL: "postgresql://postgres:password@localhost:${{ job.services.postgres.ports[5432] }}/usdr_grants_test"
-          AWS_ACCESS_KEY_ID: "Fake AWS Key"
-          AWS_SECRET_ACCESS_KEY: "Fake AWS Secret"
-          NOTIFICATIONS_EMAIL: grants-identification@usdigitalresponse.org
-          DATA_DIR: './data'
-        run: yarn serve &
-      - name: Run e2e tests
-        uses: cypress-io/github-action@v5
-        env:
-          CYPRESS_BASE_URL: 'http://localhost:8080'
-        with:
-          publish-summary: true
-          working-directory: packages/e2e
-
-  test-server-client:
-    name: "Server and Client Unit Tests"
-    runs-on: ubuntu-latest
-    services:
-      postgres:
-        image: "postgres:13"
-        env:
-          POSTGRES_DB: usdr_grants_test
-          POSTGRES_USER: postgres
-          POSTGRES_PASSWORD: password
-        ports:
-          - 5432:5432
-        # Set health checks to wait until postgres has started
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-
-    steps:
-      - uses: actions/checkout@v2
-      - name: Install Node.js
-        uses: actions/setup-node@v2
-        with:
-          node-version: 16.14.0
-          cache: yarn
-      - name: Install dependencies
-        run: yarn setup
-      - name: Run Linter
-        run: yarn lint
-      - name: Run unit tests
-        env:
-          POSTGRES_TEST_URL: "postgresql://postgres:password@localhost:${{ job.services.postgres.ports[5432] }}/usdr_grants_test"
-          # This is intentional to set POSTGRES_URL=POSTGRES_TEST_URL; ARPA Reporter test runner gates
-          # dev vs. CI differences based on whether these are the same.
-          POSTGRES_URL: "postgresql://postgres:password@localhost:${{ job.services.postgres.ports[5432] }}/usdr_grants_test"
-          AWS_ACCESS_KEY_ID: "Fake AWS Key"
-          AWS_SECRET_ACCESS_KEY: "Fake AWS Secret"
-          NOTIFICATIONS_EMAIL: grants-identification@usdigitalresponse.org
-        run: |
-          # The .env file needs to be present; the example file is good enough.
-          cp packages/server/.env.example packages/server/.env
-          cp packages/client/.env.example packages/client/.env
-          cp packages/e2e/.env.example packages/e2e/.env
-          export CI=true; yarn coverage
-      - name: Publish coverage report to CodeClimate
-        uses: paambaati/codeclimate-action@v3.2.0
-        env:
-          CC_TEST_REPORTER_ID: c0ab87c312e9ca57ec34d55ebec07ed396f96f039b3c725221918a75be71a0eb
-        with:
-          coverageLocations: |
-            ${{github.workspace}}/coverage/lcov.info:lcov
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 000000000..bf4eecba8
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,117 @@
+name: Continuous Integration
+
+on:
+  pull_request_target: {}
+
+permissions:
+  contents: read
+
+jobs:
+  qa:
+    permissions:
+      contents: read
+    uses: ./.github/workflows/qa.yml
+    with:
+      ref: ${{ github.event.pull_request.head.sha }}
+
+  publish-qa-results:
+    name: Publish QA Results
+    permissions:
+      contents: read
+      pull-requests: write
+    if: needs.qa.result != 'skipped' || needs.qa.result != 'cancelled'
+    needs:
+      - qa
+    uses: "./.github/workflows/publish-qa-results.yml"
+    with:
+      client-test-outcome: ${{ needs.qa.outputs.client-test-outcome }}
+      client-test-coverage-markdown-report: ${{ needs.qa.outputs.client-test-coverage-markdown-report }}
+      server-test-outcome: ${{ needs.qa.outputs.server-test-outcome }}
+      server-test-coverage-markdown-report: ${{ needs.qa.outputs.server-test-coverage-markdown-report }}
+      eslint-outcome: ${{ needs.qa.outputs.eslint-outcome }}
+      tflint-outcome: ${{ needs.qa.outputs.tflint-outcome }}
+      e2e-test-outcome: ${{ needs.qa.outputs.e2e-test-outcome }}
+      pr-number: ${{ github.event.pull_request.number }}
+      write-summary: true
+      write-comment: true
+
+  build:
+    permissions:
+      contents: read
+      packages: write
+    name: Build deployment artifacts
+    uses: ./.github/workflows/build.yml
+    with:
+      ref: ${{ github.event.pull_request.head.sha }}
+      build-server-image: true
+      server-image-push: true
+      server-image-args-ref: ${{ github.ref }}
+      server-image-tag-latest: false
+      server-image-tag-pr: "${{ github.event.pull_request.number }}"
+      server-image-version: "rc-pr-${{ github.event.pull_request.number }}"
+      server-image-upload-attestations: true
+      server-image-artifacts-retention-days: 14
+      build-website: true
+      website-artifact-retention-days: 14
+
+  aws-auth:
+    name: Configure AWS Credentials
+    permissions:
+      contents: read
+      id-token: write
+    uses: ./.github/workflows/aws-auth.yml
+    with:
+      aws-region: us-west-2
+    secrets:
+      role-to-assume: ${{ secrets.CI_ROLE_ARN }}
+      gpg-passphrase: ${{ secrets.TFPLAN_SECRET }}
+
+  tf-plan:
+    name: Plan Terraform
+    permissions:
+      contents: read
+    needs:
+      - aws-auth
+      - build
+    uses: ./.github/workflows/terraform-plan.yml
+    if: needs.build.outputs.build-server-image-result == 'success' && needs.build.outputs.build-website-result == 'success' && needs.aws-auth.result == 'success'
+    with:
+      ref: ${{ github.event.pull_request.head.sha }}
+      concurrency-group: run_terraform-staging
+      server-image-tag: ${{ github.event.pull_request.head.sha }}
+      server-image-digest: ${{ needs.build.outputs.server-image-digest }}
+      website-artifacts-key: ${{ needs.build.outputs.website-artifacts-key }}
+      website-artifacts-path: ${{ needs.build.outputs.website-artifacts-path }}
+      aws-region: us-west-2
+      environment-key: staging
+      tf-backend-config-file: staging.s3.tfbackend
+      tf-var-file: staging.tfvars
+      upload-artifacts: false
+      artifacts-retention-days: 14
+    secrets:
+      aws-access-key-id: ${{ needs.aws-auth.outputs.aws-access-key-id }}
+      aws-secret-access-key: ${{ needs.aws-auth.outputs.aws-secret-access-key }}
+      aws-session-token: ${{ needs.aws-auth.outputs.aws-session-token }}
+      datadog-api-key: ${{ secrets.DATADOG_API_KEY }}
+      datadog-app-key: ${{ secrets.DATADOG_APP_KEY }}
+      gpg-passphrase: ${{ secrets.TFPLAN_SECRET }}
+
+  publish-tf-plan:
+    name: Publish Terraform Plan
+    permissions:
+      contents: read
+      pull-requests: write
+    if: needs.tf-plan.result != 'skipped' || needs.tf-plan.result != 'cancelled'
+    needs:
+      - tf-plan
+    uses: ./.github/workflows/publish-terraform-plan.yml
+    with:
+      write-summary: true
+      write-comment: true
+      pr-number: ${{ github.event.pull_request.number }}
+      tf-fmt-outcome: ${{ needs.tf-plan.outputs.fmt-outcome }}
+      tf-init-outcome: ${{ needs.tf-plan.outputs.init-outcome }}
+      tf-plan-outcome: ${{ needs.tf-plan.outputs.plan-outcome }}
+      tf-plan-output: ${{ needs.tf-plan.outputs.plan-output }}
+      tf-validate-outcome: ${{ needs.tf-plan.outputs.validate-outcome }}
+      tf-validate-output: ${{ needs.tf-plan.outputs.validate-output }}
diff --git a/.github/workflows/code-scanning.yml b/.github/workflows/code-scanning.yml
new file mode 100644
index 000000000..3827edc8d
--- /dev/null
+++ b/.github/workflows/code-scanning.yml
@@ -0,0 +1,80 @@
+name: "Code Scanning"
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    - cron: '35 8 * * 1-5'
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    name: Dependency Review
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        with:
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          show-progress: 'false'
+          persist-credentials: 'false'
+      - uses: actions/dependency-review-action@6c5ccdad469c9f8a2996bfecaec55a631a347034 # v3.1.0
+
+  codeql:
+    name: CodeQL
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        with:
+          disable-sudo: true
+          egress-policy: audit
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          show-progress: 'false'
+          persist-credentials: 'false'
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@8e0b1c74b1d5a0077b04d064c76ee714d3da7637 # v2.14.6
+        with:
+          languages: javascript-typescript
+          queries: security-extended,security-and-quality
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@8e0b1c74b1d5a0077b04d064c76ee714d3da7637 # v2.14.6
+        with:
+          category: "/language:javascript-typescript"
+
+  gha-workflow-security:
+    name: GHA Workflow Security
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    permissions:
+      contents: read
+    steps:
+      - uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        with:
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          show-progress: 'false'
+          persist-credentials: 'false'
+      - name: Ensure GitHub action versions are pinned to SHAs
+        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@fdc1a0099560840b2be12459d0a61c7bc95b9db1 # v3.0.0
diff --git a/.github/workflows/dependabot-auto-approve.yml b/.github/workflows/dependabot-auto-approve.yml
index 70485e64c..05344175b 100644
--- a/.github/workflows/dependabot-auto-approve.yml
+++ b/.github/workflows/dependabot-auto-approve.yml
@@ -13,21 +13,28 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.actor == 'dependabot[bot]' }}
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        with:
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
       - name: Dependabot metadata
         id: dependabot-metadata
-        uses: dependabot/fetch-metadata@v1
+        uses: dependabot/fetch-metadata@c9c4182bf1b97f5224aee3906fd373f6b61b4526 # v1.6.0
       - name: Approve a PR if dependency semver changes are minor or patch
-        if: ${{contains(fromJson('["version-update:semver-patch", "version-update:semver-minor"]'), steps.dependabot-metadata.outputs.update-type)}}
+        if: ${{ contains(fromJson('["version-update:semver-patch", "version-update:semver-minor"]'), steps.dependabot-metadata.outputs.update-type) }}
         run: gh pr review --approve "$PR_URL"
         env:
-          PR_URL: ${{github.event.pull_request.html_url}}
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Enable auto-merge if dependency semver changes are minor or patch
-        if: ${{contains(fromJson('["version-update:semver-patch", "version-update:semver-minor"]'), steps.dependabot-metadata.outputs.update-type)}}
+        if: ${{ contains(fromJson('["version-update:semver-patch", "version-update:semver-minor"]'), steps.dependabot-metadata.outputs.update-type) }}
         run: |
           echo "Enabling auto-merge for Dependabot $UPDATE_TYPE"
           gh pr merge --auto --squash "$PR_URL"
         env:
-          PR_URL: ${{github.event.pull_request.html_url}}
-          GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
-          UPDATE_TYPE: ${{steps.dependabot-metadata.outputs.update-type}}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          UPDATE_TYPE: ${{ steps.dependabot-metadata.outputs.update-type }}
diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy-production.yml
new file mode 100644
index 000000000..9419a3349
--- /dev/null
+++ b/.github/workflows/deploy-production.yml
@@ -0,0 +1,189 @@
+name: Deploy to Production
+run-name: Deploy ${{ github.ref }}
+
+on:
+  push:
+    tags:
+      - 'release/**'
+  workflow_dispatch:
+
+concurrency:
+  group: deploy-production
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  validate:
+    name: Validate commits for deployment
+    permissions:
+      contents: read
+    uses: ./.github/workflows/validate-deployment.yml
+    with:
+      protected-ref: main
+      deployment-ref: ${{ github.ref }}
+
+  build:
+    name: Build deployment artifacts
+    permissions:
+      contents: read
+      packages: write
+    needs:
+      - validate
+    uses: ./.github/workflows/build.yml
+    with:
+      ref: ${{ github.sha }}
+      build-server-image: true
+      server-image-push: true
+      server-image-args-ref: ${{ github.ref }}
+      server-image-version: ${{ github.ref_name }}
+      server-image-tag-latest: false
+      server-image-tag-release: ${{ github.ref_name }}
+      server-image-upload-attestations: true
+      server-image-artifacts-retention-days: 90
+      build-website: true
+      website-artifact-retention-days: 90
+
+  aws-auth:
+    name: Configure AWS Credentials
+    permissions:
+      contents: read
+      id-token: write
+    needs:
+      - validate
+    uses: ./.github/workflows/aws-auth.yml
+    with:
+      aws-region: us-west-2
+    secrets:
+      gpg-passphrase: ${{ secrets.PRODUCTION_GPG_PASSPHRASE }}
+      role-to-assume: ${{ secrets.PRODUCTION_ROLE_ARN }}
+
+  tf-plan:
+    name: Plan Terraform
+    permissions:
+      contents: read
+    needs:
+      - validate
+      - aws-auth
+      - build
+    uses: ./.github/workflows/terraform-plan.yml
+    with:
+      ref: ${{ github.sha }}
+      concurrency-group: run_terraform-production
+      server-image-tag: ${{ github.sha }}
+      server-image-digest: ${{ needs.build.outputs.server-image-digest }}
+      website-artifacts-key: ${{ needs.build.outputs.website-artifacts-key }}
+      website-artifacts-path: ${{ needs.build.outputs.website-artifacts-path }}
+      aws-region: us-west-2
+      environment-key: production
+      tf-backend-config-file: prod.s3.tfbackend
+      tf-var-file: prod.tfvars
+      upload-artifacts: true
+      artifacts-retention-days: 90
+    secrets:
+      aws-access-key-id: ${{ needs.aws-auth.outputs.aws-access-key-id }}
+      aws-secret-access-key: ${{ needs.aws-auth.outputs.aws-secret-access-key }}
+      aws-session-token: ${{ needs.aws-auth.outputs.aws-session-token }}
+      datadog-api-key: ${{ secrets.DATADOG_API_KEY }}
+      datadog-app-key: ${{ secrets.DATADOG_APP_KEY }}
+      gpg-passphrase: ${{ secrets.PRODUCTION_GPG_PASSPHRASE }}
+
+  publish-tf-plan:
+    name: Publish Terraform Plan
+    permissions:
+      contents: read
+      pull-requests: write
+    if: needs.tf-plan.result != 'skipped' || needs.tf-plan.result != 'cancelled'
+    needs:
+      - tf-plan
+    uses: ./.github/workflows/publish-terraform-plan.yml
+    with:
+      write-summary: true
+      write-comment: false
+      tf-fmt-outcome: ${{ needs.tf-plan.outputs.fmt-outcome }}
+      tf-init-outcome: ${{ needs.tf-plan.outputs.init-outcome }}
+      tf-plan-outcome: ${{ needs.tf-plan.outputs.plan-outcome }}
+      tf-plan-output: ${{ needs.tf-plan.outputs.plan-output }}
+      tf-validate-outcome: ${{ needs.tf-plan.outputs.validate-outcome }}
+      tf-validate-output: ${{ needs.tf-plan.outputs.validate-output }}
+
+  tf-apply:
+    name: Deploy to Production
+    needs:
+      - build
+      - aws-auth
+      - tf-plan
+    if: needs.tf-plan.outputs.plan-exitcode == 2
+    uses: ./.github/workflows/terraform-apply.yml
+    with:
+      website-artifacts-key: ${{ needs.build.outputs.website-artifacts-key }}
+      website-artifacts-path: ${{ needs.build.outputs.website-artifacts-path }}
+      tf-plan-artifacts-key: ${{ needs.tf-plan.outputs.artifacts-key }}
+      aws-region: us-west-2
+      concurrency-group: run_terraform-production
+      tf-backend-config-file: prod.s3.tfbackend
+      environment-name: production
+    secrets:
+      aws-access-key-id: ${{ needs.aws-auth.outputs.aws-access-key-id }}
+      aws-secret-access-key: ${{ needs.aws-auth.outputs.aws-secret-access-key }}
+      aws-session-token: ${{ needs.aws-auth.outputs.aws-session-token }}
+      datadog-api-key: ${{ secrets.DATADOG_API_KEY }}
+      datadog-app-key: ${{ secrets.DATADOG_APP_KEY }}
+      gpg-passphrase: ${{ secrets.PRODUCTION_GPG_PASSPHRASE }}
+
+  update-release:
+    name: Update release
+    runs-on: ubuntu-latest
+    if: startsWith('refs/tags/release/', github.ref)
+    permissions:
+      contents: write
+    needs:
+      - build
+      - tf-apply
+    env:
+      GH_TOKEN: ${{ github.token }}
+      RELEASE_TAG: ${{ github.ref_name }}
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        with:
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - name: Download website build artifacts
+        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
+        with:
+          name: ${{ needs.build.outputs.website-artifacts-key }}
+          path: ${{ needs.build.outputs.website-artifacts-path }}
+      - name: Download docker build attestation artifacts
+        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
+        with:
+          name: ${{ needs.build.outputs.server-attestation-artifacts-key }}
+          path: ${{ needs.build.outputs.server-attestation-artifacts-path }}
+      - name: Upload release assets
+        run: |
+          WEBSITE_TAR_FILE="client-dist.tar.gz"
+          tar -czf "$WEBSITE_TAR_FILE" -C $(dirname "$WEBSITE_DIST_PATH") .
+          gh release upload --clobber "$RELEASE_TAG" \
+            "$WEBSITE_TAR_FILE#Client website bundle" \
+            "$PROVENANCE_FILE#Server Docker image provenance attestations" \
+            "$SBOM_FILE#Server Docker image SBOM attestations"
+        env:
+          WEBSITE_DIST_PATH: ${{ needs.build.outputs.website-artifacts-path }}
+          PROVENANCE_FILE: ${{ needs.build.outputs.server-attestation-artifacts-path }}/provenance.json
+          SBOM_FILE: ${{ needs.build.outputs.server-attestation-artifacts-path }}/sbom.sdpx.json
+      - name: Get release notes
+        id: get
+        continue-on-error: true
+        run: gh release view "$RELEASE_TAG" --json body --jq .body > release_notes.md
+      - name: Add deployment history to release notes
+        if: always() && steps.get.outcome == 'success'
+        run: printf "\n- Deployed at $(date --iso-8601=seconds)\n" >> release_notes.md
+      - name: Update release notes and status
+        if: always() && steps.get.outcome == 'success'
+        run: gh release edit "$RELEASE_TAG" --draft=false --prerelease=false --latest --verify-tag -F release_notes.md
diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
new file mode 100644
index 000000000..3af3a6413
--- /dev/null
+++ b/.github/workflows/deploy-staging.yml
@@ -0,0 +1,129 @@
+name: Deploy to Staging
+
+on:
+  push:
+    branches:
+      - main
+
+concurrency:
+  group: deploy-staging
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  validate:
+    name: Validate commits for deployment
+    permissions:
+      contents: read
+    uses: ./.github/workflows/validate-deployment.yml
+    with:
+      protected-ref: main
+      deployment-ref: ${{ github.ref }}
+
+  build:
+    name: Build deployment artifacts
+    permissions:
+      contents: read
+      packages: write
+    needs:
+      - validate
+    uses: ./.github/workflows/build.yml
+    with:
+      ref: ${{ github.sha }}
+      build-server-image: true
+      server-image-push: true
+      server-image-args-ref: ${{ github.ref }}
+      server-image-version: "rc-${{ github.sha }}"
+      server-image-tag-latest: true
+      build-website: true
+      website-artifact-retention-days: 14
+
+  aws-auth:
+    name: Configure AWS Credentials
+    permissions:
+      contents: read
+      id-token: write
+    needs:
+      - validate
+    uses: ./.github/workflows/aws-auth.yml
+    with:
+      aws-region: us-west-2
+    secrets:
+      gpg-passphrase: ${{ secrets.STAGING_GPG_PASSPHRASE }}
+      role-to-assume: ${{ secrets.STAGING_ROLE_ARN }}
+
+  tf-plan:
+    name: Plan Terraform
+    permissions:
+      contents: read
+    needs:
+      - validate
+      - aws-auth
+      - build
+    uses: ./.github/workflows/terraform-plan.yml
+    with:
+      ref: ${{ github.sha }}
+      concurrency-group: run_terraform-staging
+      server-image-tag: ${{ github.sha }}
+      server-image-digest: ${{ needs.build.outputs.server-image-digest }}
+      website-artifacts-key: ${{ needs.build.outputs.website-artifacts-key }}
+      website-artifacts-path: ${{ needs.build.outputs.website-artifacts-path }}
+      aws-region: us-west-2
+      environment-key: staging
+      tf-backend-config-file: staging.s3.tfbackend
+      tf-var-file: staging.tfvars
+      upload-artifacts: true
+      artifacts-retention-days: 30
+    secrets:
+      aws-access-key-id: ${{ needs.aws-auth.outputs.aws-access-key-id }}
+      aws-secret-access-key: ${{ needs.aws-auth.outputs.aws-secret-access-key }}
+      aws-session-token: ${{ needs.aws-auth.outputs.aws-session-token }}
+      datadog-api-key: ${{ secrets.DATADOG_API_KEY }}
+      datadog-app-key: ${{ secrets.DATADOG_APP_KEY }}
+      gpg-passphrase: ${{ secrets.STAGING_GPG_PASSPHRASE }}
+
+  publish-tf-plan:
+    name: Publish Terraform Plan
+    permissions:
+      contents: read
+      pull-requests: write
+    if: needs.tf-plan.result != 'skipped' || needs.tf-plan.result != 'cancelled'
+    needs:
+      - tf-plan
+    uses: ./.github/workflows/publish-terraform-plan.yml
+    with:
+      write-summary: true
+      write-comment: false
+      tf-fmt-outcome: ${{ needs.tf-plan.outputs.fmt-outcome }}
+      tf-init-outcome: ${{ needs.tf-plan.outputs.init-outcome }}
+      tf-plan-outcome: ${{ needs.tf-plan.outputs.plan-outcome }}
+      tf-plan-output: ${{ needs.tf-plan.outputs.plan-output }}
+      tf-validate-outcome: ${{ needs.tf-plan.outputs.validate-outcome }}
+      tf-validate-output: ${{ needs.tf-plan.outputs.validate-output }}
+
+  tf-apply:
+    name: Deploy to Staging
+    needs:
+      - build
+      - aws-auth
+      - tf-plan
+    if: needs.tf-plan.outputs.plan-exitcode == 2
+    uses: ./.github/workflows/terraform-apply.yml
+    with:
+      website-artifacts-key: ${{ needs.build.outputs.website-artifacts-key }}
+      website-artifacts-path: ${{ needs.build.outputs.website-artifacts-path }}
+      tf-plan-artifacts-key: ${{ needs.tf-plan.outputs.artifacts-key }}
+      aws-region: us-west-2
+      concurrency-group: run_terraform-staging
+      tf-backend-config-file: staging.s3.tfbackend
+      environment-name: staging
+    secrets:
+      aws-access-key-id: ${{ needs.aws-auth.outputs.aws-access-key-id }}
+      aws-secret-access-key: ${{ needs.aws-auth.outputs.aws-secret-access-key }}
+      aws-session-token: ${{ needs.aws-auth.outputs.aws-session-token }}
+      datadog-api-key: ${{ secrets.DATADOG_API_KEY }}
+      datadog-app-key: ${{ secrets.DATADOG_APP_KEY }}
+      gpg-passphrase: ${{ secrets.STAGING_GPG_PASSPHRASE }}
diff --git a/.github/workflows/pr-tidying.yml b/.github/workflows/pr-tidying.yml
new file mode 100644
index 000000000..5516923bc
--- /dev/null
+++ b/.github/workflows/pr-tidying.yml
@@ -0,0 +1,211 @@
+name: Pull Request Tidying
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - ready_for_review
+      - unassigned
+      - edited
+      - unlocked
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  default-assignee:
+    # Disabled for now
+    if: false
+    name: Assign contributor
+    continue-on-error: true
+    permissions:
+      pull-requests: write
+    runs-on: ubuntu-latest
+    outputs:
+      check-passed: ${{ steps.check.outputs.result == 'passed' }}
+      fixed: ${{ steps.fix.outputs.result == 'fixed' }}
+    env:
+      DEFAULT_ASSIGNEE: ${{ github.actor }}
+    steps:
+      - uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        with:
+          disable-sudo: true
+          egress-policy: audit
+      - name: Check if PR already has assignee
+        id: check
+        run: |
+          if [[ -n $CURRENT_ASSIGNEE ]]; then
+            echo "result=passed" >> $GITHUB_OUTPUT
+          fi
+        env:
+          CURRENT_ASSIGNEE: ${{ github.event.pull_request.assignee.login || '' }}
+      - id: skip-edited-event
+        if: github.event.action == 'edited'
+        run: |
+          echo "Fix will be skipped because the triggering action is an edit event"
+          exit 1
+      - id: prevent-reassignment
+        if: github.event.action == 'unassigned' && env.DEFAULT_ASSIGNEE == github.event.assignee.login
+        run: |
+          echo "Fix will be skipped to avoid reassigning the unassigned user"
+          exit 1
+      - name: Add assignee
+        id: fix
+        if: steps.check.outputs.result != 'passed'
+        run: |
+          level=$(gh api /repos/$REPO/collaborators/$AUTHOR/permission --jq .permission)
+          if [[ $level = "write" || $level = "admin" ]]; then
+            gh pr edit "$PR_NUMBER" --repo "$REPO" --add-assignee "$AUTHOR"
+            echo "result=fixed" >> $GITHUB_OUTPUT
+          fi
+        env:
+          REPO: ${{ github.repository }}
+          AUTHOR: ${{ env.DEFAULT_ASSIGNEE }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  issue-in-title:
+    # Disabled for now
+    if: false
+    name: Add issue references to title
+    continue-on-error: true
+    runs-on: ubuntu-latest
+    outputs:
+      check-passed: ${{ steps.check.outputs.result == 'passed' }}
+      fixed: ${{ steps.fix.outputs.result == 'fixed' }}
+    steps:
+      - uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        with:
+          disable-sudo: true
+          egress-policy: audit
+      - name: Check the current PR title
+        id: check
+        run: |
+          regex='\s\([#][0-9]+\s?\)$'
+          if [[ $PR_TITLE =~ $regex ]]; then
+            echo "result=passed" >> $GITHUB_OUTPUT
+          fi
+      - id: skip-unassigned-event
+        if: github.event.action == 'unassigned'
+        run: |
+          echo "Fix will be skipped because the triggering action is an unassignment event"
+          exit 1
+      - id: skip-non-title-edits
+        if: github.event.action == 'edited' && github.event.changes.title.from == github.event.pull_request.title
+        run: |
+          echo "Fix will be skipped because the triggering edit action did not modify the PR title"
+          exit 1
+      - name: Parse issue(s) from Ticket heading
+        id: parse
+        if: steps.check.outputs.result != 'passed'
+        run: |
+          regex='^[#][#][#] Ticket (([#][0-9]+\s?)+)'
+          line=$(gh pr view "$PR_NUMBER" --json body --jq .body | head -n 1)
+          issues=''
+          if [[ $line =~ $regex ]]; then
+            issues="${BASH_REMATCH[1]}"
+          fi
+          echo "issue-numbers=$(tr -s '[:blank:]' <<< $issues)" >> $GITHUB_OUTPUT
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - id: skip-empty-issues
+        if: steps.parse.outputs.issue-numbers == ''
+        run: |
+          echo "Fix will be skipped because no issue numbers were parsed"
+          exit 1
+      - name: Format the new title
+        id: new-title
+        run: echo result="$ORIGINAL_TITLE (issue $ISSUE_NUMBERS)" >> $GITHUB_OUTPUT
+        env:
+          ORIGINAL_TITLE: ${{ github.event.pull_request.title }}
+          ISSUE_NUMBERS: ${{ steps.parse.outputs.issue-numbers }}
+      - id: skip-prevent-revert
+        if: github.event.action == 'edited' && github.event.changes.title.from == steps.new-title.outputs.result
+        run: |
+          echo "Fix will be skipped to avoid setting the title back to its previous value"
+          exit 1
+      - name: Update PR title
+        id: fix
+        if: steps.check.outputs.result != 'passed' && steps.parse.outputs.issue-numbers != ''
+        run: |
+          gh pr edit "$PR_NUMBER" --title "$ORIGINAL_TITLE (issue $ISSUE_NUMBERS)"
+          echo "result=fixed" >> $GITHUB_OUTPUT
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          ORIGINAL_TITLE: ${{ github.event.pull_request.title }}
+          ISSUE_NUMBERS: ${{ steps.parse.outputs.issue-numbers }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  comment:
+    name: Create/update PR comment
+    # Disabled for now
+    if: always() && github.actor != 'dependabot[bot]' && false
+    needs:
+      - default-assignee
+      - issue-in-title
+    runs-on: ubuntu-latest
+    steps:
+      - uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        with:
+          disable-sudo: true
+          egress-policy: audit
+      - name: Create comment file
+        run: |
+          COMMENT_FILE=$(mktemp -t comment.md.XXXXX)
+          echo "COMMENT_FILE=$COMMENT_FILE" >> $GITHUB_ENV
+          cat >> $COMMENT_FILE << 'ENDOFCOMMENT'
+          ## PR Helper Bot 🤖
+
+          **Thanks for your pull request!**
+          My job is to check for any missing conventions and automatically tidy things up (if I can).
+          You'll find the results below, along with any suggested actions for you to take.
+
+          <details>
+          <summary>Result key</summary>
+          ✅ = Already passing
+          🛠️ = Fixed (now passing)
+          ⚠️  = Consider fixing
+          </details>
+
+          | Convention                           | Result |
+          |:-------------------------------------|:------:|
+          | PR has assignee (defaults to author) | ${{ env.DEFAULT_ASSIGNEE }} |
+          | PR title ends with `(#issue)`        | ${{ env.ISSUE_IN_TITLE }}   |
+
+          *Pusher: @${{ env.GH_ACTOR }}, Action: `${{ env.GH_ACTION }}`, Workflow: [`${{ env.GH_WORKFLOW }}`](${{ env.GH_SERVER}}/${{ env.GH_REPO }}/actions/runs/${{ env.GH_RUN_ID }})*
+          ENDOFCOMMENT
+        env:
+          DEFAULT_ASSIGNEE: ${{ (needs.default-assignee.outputs.check-passed && '✅' ) || (needs.default-assignee.outputs.fixed && '🛠️') || '⚠️' }}
+          ISSUE_IN_TITLE: ${{ (needs.issue-in-title.outputs.check-passed && '✅' ) || (needs.issue-in-title.outputs.fixed && '🛠️') || '⚠️' }}
+          GH_ACTOR: ${{ github.actor }}
+          GH_ACTION: ${{ github.event_name }}
+          GH_WORKFLOW: ${{ github.workflow }}
+          GH_SERVER: ${{ github.server_url }}
+          GH_REPO: ${{ github.repository }}
+          GH_RUN_ID: ${{ github.run_id }}
+      - name: Output comment body to step summary
+        run: cat $COMMENT_FILE >> $GITHUB_STEP_SUMMARY
+      - name: Write the comment body
+        id: comment-body
+        run: |
+          CONTENT=$(cat $COMMENT_FILE)
+          echo "COMMENT_CONTENT<<ENDOFREPORT" >> $GITHUB_OUTPUT
+          echo "$CONTENT" >> $GITHUB_OUTPUT
+          echo "ENDOFREPORT" >> $GITHUB_OUTPUT
+      - name: Find previous report comment
+        id: find-comment
+        uses: peter-evans/find-comment@a54c31d7fa095754bfef525c0c8e5e5674c4b4b1 # v2.4.0
+        with:
+          issue-number: ${{ github.event.pull_request.number }}
+          comment-author: 'github-actions[bot]'
+          body-includes: 'PR Helper Bot 🤖'
+      - name: Create or update comment
+        uses: peter-evans/create-or-update-comment@23ff15729ef2fc348714a3bb66d2f655ca9066f2 # v3.1.0
+        with:
+          comment-id: ${{ steps.find-comment.outputs.comment-id }}
+          issue-number: ${{ github.event.pull_request.number }}
+          body: ${{ steps.comment-body.outputs.COMMENT_CONTENT }}
+          edit-mode: replace
diff --git a/.github/workflows/publish-qa-results.yml b/.github/workflows/publish-qa-results.yml
new file mode 100644
index 000000000..8b4a3e48b
--- /dev/null
+++ b/.github/workflows/publish-qa-results.yml
@@ -0,0 +1,128 @@
+name: Publish QA Results
+
+on:
+  workflow_call:
+    inputs:
+      client-test-outcome:
+        type: string
+        required: true
+      client-test-coverage-markdown-report:
+        type: string
+        required: true
+      server-test-outcome:
+        type: string
+        required: true
+      server-test-coverage-markdown-report:
+        type: string
+        required: true
+      e2e-test-outcome:
+        type: string
+        required: true
+      eslint-outcome:
+        type: string
+        required: true
+      tflint-outcome:
+        type: string
+        required: true
+      pr-number:
+        type: string
+        required: false
+      write-summary:
+        type: boolean
+        default: true
+      write-comment:
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  publish:
+    name: Publish QA Results
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        with:
+          disable-sudo: true
+          egress-policy: audit
+      - name: Write the report markdown file
+        run: |
+          REPORT_FILE=$(mktemp -t summary.md.XXXXX)
+          echo "REPORT_FILE=$REPORT_FILE" >> $GITHUB_ENV
+          cat >> $REPORT_FILE << 'ENDOFREPORT'
+          ## QA Summary
+
+          | QA Check        | Result  |
+          |:----------------|:-------:|
+          | 🌐 Client Tests | ${{ (env.CLIENT_TEST_OUTCOME == 'success' && '✅') || (env.CLIENT_TEST_OUTCOME == 'skipped' && '➖') || '❌' }} |
+          | 🔗 Server Tests | ${{ (env.SERVER_TEST_OUTCOME == 'success' && '✅') || (env.SERVER_TEST_OUTCOME == 'skipped' && '➖') || '❌' }} |
+          | 🤝 E2E Tests    | ${{ (env.E2E_TEST_OUTCOME == 'success' && '✅') || (env.E2E_TEST_OUTCOME == 'skipped' && '➖') || '❌' }} |
+          | 📏 ESLint       | ${{ (env.ESLINT_OUTCOME == 'success' && '✅') || (env.ESLINT_OUTCOME == 'skipped' && '➖') || '❌' }} |
+          | 🧹 TFLint       | ${{ (env.TFLINT_OUTCOME == 'success' && '✅') || (env.TFLINT_OUTCOME == 'skipped' && '➖') || '❌' }} |
+
+          ### Test Coverage
+
+          <details>
+          <summary>Coverage report for `packages/client`</summary>
+
+          ${{ env.CLIENT_COVERAGE_REPORT }}
+
+          </details>
+
+          <details>
+          <summary>Coverage report for `packages/server`</summary>
+
+          ${{ env.SERVER_COVERAGE_REPORT }}
+
+          </details>
+
+          *Pusher: @${{ env.GH_ACTOR }}, Action: `${{ env.GH_ACTION }}`, Workflow: [`${{ env.GH_WORKFLOW }}`](${{ env.GH_SERVER}}/${{ env.GH_REPO }}/actions/runs/${{ env.GH_RUN_ID }})*
+          ENDOFREPORT
+        env:
+          CLIENT_TEST_OUTCOME: ${{ inputs.client-test-outcome }}
+          CLIENT_COVERAGE_REPORT: ${{ inputs.client-test-coverage-markdown-report }}
+          SERVER_TEST_OUTCOME: ${{ inputs.server-test-outcome }}
+          SERVER_COVERAGE_REPORT: ${{ inputs.server-test-coverage-markdown-report }}
+          E2E_TEST_OUTCOME: ${{ inputs.e2e-test-outcome }}
+          ESLINT_OUTCOME: ${{ inputs.eslint-outcome }}
+          TFLINT_OUTCOME: ${{ inputs.tflint-outcome }}
+          GH_ACTOR: ${{ github.actor }}
+          GH_ACTION: ${{ github.event_name }}
+          GH_WORKFLOW: ${{ github.workflow }}
+          GH_SERVER: ${{ github.server_url }}
+          GH_REPO: ${{ github.repository }}
+          GH_RUN_ID: ${{ github.run_id }}
+      - name: Write the step summary
+        if: inputs.write-summary
+        run: cat $REPORT_FILE | head -c 65500 >> $GITHUB_STEP_SUMMARY # Observe GitHub's 65535 character limit
+      - name: Write the comment body
+        id: comment-body
+        run: |
+          CONTENT=$(cat $REPORT_FILE)
+          echo "REPORT_CONTENT<<ENDOFREPORT" >> $GITHUB_OUTPUT
+          echo "$CONTENT" >> $GITHUB_OUTPUT
+          echo "ENDOFREPORT" >> $GITHUB_OUTPUT
+      - name: Warn on missing comment requirements
+        if: inputs.write-comment && inputs.pr-number == ''
+        run: "echo 'WARNING: Cannot write a comment because pr-number is not set'"
+      - name: Find previous report comment
+        id: find-comment
+        if: inputs.write-comment && inputs.pr-number != ''
+        uses: peter-evans/find-comment@a54c31d7fa095754bfef525c0c8e5e5674c4b4b1 # v2.4.0
+        with:
+          issue-number: ${{ inputs.pr-number }}
+          comment-author: 'github-actions[bot]'
+          body-includes: QA Summary
+      - name: Create or update comment
+        if: inputs.write-comment && inputs.pr-number != ''
+        uses: peter-evans/create-or-update-comment@23ff15729ef2fc348714a3bb66d2f655ca9066f2 # v3.1.0
+        with:
+          comment-id: ${{ steps.find-comment.outputs.comment-id }}
+          issue-number: ${{ github.event.pull_request.number }}
+          body: ${{ steps.comment-body.outputs.REPORT_CONTENT }}
+          edit-mode: replace
diff --git a/.github/workflows/publish-terraform-plan.yml b/.github/workflows/publish-terraform-plan.yml
new file mode 100644
index 000000000..9bb93a39a
--- /dev/null
+++ b/.github/workflows/publish-terraform-plan.yml
@@ -0,0 +1,139 @@
+name: Publish Terraform Plan
+
+on:
+  workflow_call:
+    inputs:
+      tf-fmt-outcome:
+        type: string
+        required: true
+      tf-init-outcome:
+        type: string
+        required: true
+      tf-plan-outcome:
+        type: string
+        required: true
+      tf-plan-output:
+        type: string
+        required: true
+      tf-validate-outcome:
+        type: string
+        required: true
+      tf-validate-output:
+        type: string
+        required: true
+      pr-number:
+        type: string
+        required: false
+      write-summary:
+        type: boolean
+        default: true
+      write-comment:
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  publish:
+    name: Publish Terraform Plan
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        with:
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+      - name: Reformat Plan
+        run: |
+          PLAN=$(echo "$PLAN_RAW_OUTPUT" | sed -E 's/^([[:space:]]+)([-+])/\2\1/g')
+          echo "PLAN_REFORMATTED<<EOF" >> $GITHUB_ENV
+          echo "$PLAN" >> $GITHUB_ENV
+          echo "EOF" >> $GITHUB_ENV
+        env:
+          PLAN_RAW_OUTPUT: ${{ inputs.tf-plan-output }}
+      - name: Write the report markdown file
+        run: |
+          REPORT_FILE=$(mktemp -t summary.md.XXXXX)
+          echo "REPORT_FILE=$REPORT_FILE" >> $GITHUB_ENV
+          cat >> $REPORT_FILE << 'ENDOFREPORT'
+          ## Terraform Summary
+
+          | Step                         | Result  |
+          |:-----------------------------|:-------:|
+          | 🖌  Terraform Format & Style | ${{ (env.TF_FMT_OUTCOME == 'success' && '✅') || (env.TF_FMT_OUTCOME == 'skipped' && '➖') || '❌'  }} |
+          | ⚙️  Terraform Initialization  | ${{ (env.TF_INIT_OUTCOME == 'success' && '✅') || (env.TF_INIT_OUTCOME == 'skipped' && '➖') || '❌' }} |
+          | 🤖  Terraform Validation     | ${{ (env.TF_VALIDATE_OUTCOME == 'success' && '✅') || (env.TF_VALIDATE_OUTCOME == 'skipped' && '➖') || '❌' }} |
+          | 📖  Terraform Plan           | ${{ (env.TF_PLAN_OUTCOME == 'success' && '✅') || (env.TF_PLAN_OUTCOME == 'skipped' && '➖') || '❌' }} |
+
+          _**Hint:** If "Terraform Format & Style" failed, run `terraform fmt -recursive` from the `terraform/` directory and commit the results._
+
+          ### Output
+
+          <details>
+          <summary>Validation Output</summary>
+
+          ```
+          ${{ env.TF_VALIDATE_OUTPUT }}
+          ```
+
+          </details>
+
+          <details>
+          <summary>Plan Output</summary>
+
+          ```diff
+          ${{ env.TF_PLAN_OUTPUT }}
+          ```
+
+          </details>
+
+          *Pusher: @${{ env.GH_ACTOR }}, Action: `${{ env.GH_ACTION }}`, Workflow: [`${{ env.GH_WORKFLOW }}`](${{ env.GH_SERVER}}/${{ env.GH_REPO }}/actions/runs/${{ env.GH_RUN_ID }})*
+          ENDOFREPORT
+        env:
+          TF_FMT_OUTCOME: ${{ inputs.tf-fmt-outcome }}
+          TF_INIT_OUTCOME: ${{ inputs.tf-init-outcome }}
+          TF_VALIDATE_OUTCOME: ${{ inputs.tf-validate-outcome }}
+          TF_VALIDATE_OUTPUT: ${{ inputs.tf-validate-output }}
+          TF_PLAN_OUTCOME: ${{ inputs.tf-plan-outcome }}
+          TF_PLAN_OUTPUT: ${{ env.PLAN_REFORMATTED }}
+          GH_ACTOR: ${{ github.actor }}
+          GH_ACTION: ${{ github.event_name }}
+          GH_WORKFLOW: ${{ github.workflow }}
+          GH_SERVER: ${{ github.server_url }}
+          GH_REPO: ${{ github.repository }}
+          GH_RUN_ID: ${{ github.run_id }}
+      - name: Write the step summary
+        if: inputs.write-summary
+        run: cat $REPORT_FILE | head -c 65500 >> $GITHUB_STEP_SUMMARY # Observe GitHub's 65535 character limit
+      - name: Write the comment body
+        id: comment-body
+        run: |
+          CONTENT=$(cat $REPORT_FILE)
+          echo "REPORT_CONTENT<<ENDOFREPORT" >> $GITHUB_OUTPUT
+          echo "$CONTENT" >> $GITHUB_OUTPUT
+          echo "ENDOFREPORT" >> $GITHUB_OUTPUT
+      - name: Warn on missing comment requirements
+        if: inputs.write-comment && inputs.pr-number == ''
+        run: "echo 'WARNING: Cannot write a comment because pr-number is not set'"
+      - name: Find previous report comment
+        id: find-comment
+        if: inputs.write-comment && inputs.pr-number != ''
+        uses: peter-evans/find-comment@a54c31d7fa095754bfef525c0c8e5e5674c4b4b1 # v2.4.0
+        with:
+          issue-number: ${{ inputs.pr-number }}
+          comment-author: 'github-actions[bot]'
+          body-includes: Terraform Summary
+      - name: Create or update comment
+        if: inputs.write-comment && inputs.pr-number != ''
+        uses: peter-evans/create-or-update-comment@23ff15729ef2fc348714a3bb66d2f655ca9066f2 # v3.1.0
+        with:
+          comment-id: ${{ steps.find-comment.outputs.comment-id }}
+          issue-number: ${{ github.event.pull_request.number }}
+          body: ${{ steps.comment-body.outputs.REPORT_CONTENT }}
+          edit-mode: replace
diff --git a/.github/workflows/qa.yml b/.github/workflows/qa.yml
new file mode 100644
index 000000000..5701c769d
--- /dev/null
+++ b/.github/workflows/qa.yml
@@ -0,0 +1,282 @@
+name: QA Checks
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        type: string
+        required: true
+    outputs:
+      server-test-outcome:
+        value: ${{ jobs.test-server.result }}
+      server-test-coverage-markdown-report:
+        value: ${{ jobs.test-server.outputs.coverage-markdown-report }}
+      client-test-outcome:
+        value: ${{ jobs.test-client.result }}
+      client-test-coverage-markdown-report:
+        value: ${{ jobs.test-client.outputs.coverage-markdown-report }}
+      e2e-test-outcome:
+        value: ${{ jobs.test-e2e.result }}
+      eslint-outcome:
+        value: ${{ jobs.eslint.result }}
+      tflint-outcome:
+        value: ${{ jobs.tflint.result }}
+
+permissions:
+  contents: read
+
+jobs:
+  prepare-qa:
+    name: Prepare for QA
+    runs-on: ubuntu-latest
+    steps:
+      - uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        with:
+          disable-sudo: true
+          egress-policy: audit
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          ref: ${{ inputs.ref }}
+          show-progress: 'false'
+          persist-credentials: 'false'
+      - name: Setup Node
+        uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
+        with:
+          node-version-file: .nvmrc
+          cache: yarn
+          cache-dependency-path: yarn.lock
+      - name: Install dependencies
+        run: yarn install --frozen-lockfile
+        env:
+          CI: "true"
+
+  test-server:
+    name: Test server-side code
+    runs-on: ubuntu-latest
+    needs:
+      - prepare-qa
+    outputs:
+      coverage-markdown-report: ${{ steps.coverage-markdown.outputs.markdownReport }}
+    services:
+      postgres:
+        image: "postgres:13"
+        env:
+          POSTGRES_DB: usdr_grants_test
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: password
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    steps:
+      - uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        with:
+          disable-sudo: true
+          egress-policy: audit
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          ref: ${{ inputs.ref }}
+          show-progress: 'false'
+          persist-credentials: 'false'
+      - name: Setup Node
+        uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
+        with:
+          node-version-file: .nvmrc
+          cache: yarn
+          cache-dependency-path: yarn.lock
+      - name: Install dependencies
+        run: yarn workspace server install -D --frozen-lockfile
+        env:
+          CI: "true"
+      - name: Prepare test execution environment
+        run: cp packages/server/.env.example packages/server/.env
+      - name: Run unit tests with coverage
+        run: yarn workspace server coverage
+        env:
+          AWS_ACCESS_KEY_ID: test
+          AWS_SECRET_ACCESS_KEY: test
+          CI: "true"
+          POSTGRES_TEST_URL: "postgresql://postgres:password@localhost:${{ job.services.postgres.ports[5432] }}/usdr_grants_test"
+          POSTGRES_URL: "postgresql://postgres:password@localhost:${{ job.services.postgres.ports[5432] }}/usdr_grants_test"
+          NOTIFICATIONS_EMAIL: grants-identification@usdigitalresponse.org
+      - name: Generate coverage text report
+        run: npx nyc report --reporter text --cwd packages/server > packages/server/coverage.txt
+      - name: Generate coverage markdown report
+        id: coverage-markdown
+        uses: fingerprintjs/action-coverage-report-md@b7fcda0d2891d215c6808d32ca249e43f55abe3f # v1.0.6
+        with:
+          textReportPath: 'packages/server/coverage.txt'
+          srcBasePath: 'packages/server/'
+
+  test-client:
+    name: Test client-side code
+    runs-on: ubuntu-latest
+    needs:
+      - prepare-qa
+    outputs:
+      coverage-markdown-report: ${{ steps.coverage-markdown.outputs.markdownReport }}
+    steps:
+      - uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        with:
+          disable-sudo: true
+          egress-policy: audit
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          ref: ${{ inputs.ref }}
+          show-progress: 'false'
+          persist-credentials: 'false'
+      - name: Setup Node
+        uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
+        with:
+          node-version-file: .nvmrc
+          cache: yarn
+          cache-dependency-path: yarn.lock
+      - name: Install dependencies
+        run: yarn workspace client install -D --frozen-lockfile
+        env:
+          CI: "true"
+      - name: Prepare test execution environment
+        run: cp packages/client/.env.example packages/client/.env
+      - name: Run unit tests with coverage
+        run: yarn workspace client coverage
+        env:
+          CI: "true"
+      - name: Generate coverage text report
+        run: npx nyc report --reporter text --cwd packages/client > packages/client/coverage.txt
+      - name: Generate coverage markdown report
+        id: coverage-markdown
+        uses: fingerprintjs/action-coverage-report-md@b7fcda0d2891d215c6808d32ca249e43f55abe3f # v1.0.6
+        with:
+          textReportPath: 'packages/client/coverage.txt'
+          srcBasePath: 'packages/client/'
+
+  test-e2e:
+    name: Test end-to-end integration
+    runs-on: ubuntu-latest
+    needs:
+      - prepare-qa
+    services:
+      postgres:
+        image: "postgres:13"
+        env:
+          POSTGRES_DB: usdr_grants_test
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: password
+        ports:
+          - 5432:5432
+        # Set health checks to wait until postgres has started
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    steps:
+      - uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        with:
+          disable-sudo: true
+          egress-policy: audit
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          ref: ${{ inputs.ref }}
+          show-progress: 'false'
+          persist-credentials: 'false'
+      - name: Install Node.js
+        uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
+        with:
+          node-version-file: .nvmrc
+          cache: yarn
+          cache-dependency-path: yarn.lock
+      - name: Install dependencies
+        run: yarn install --frozen-lockfile
+        env:
+          CI: "1"
+      - name: Run migrations
+        env:
+          POSTGRES_TEST_URL: "postgresql://postgres:password@localhost:${{ job.services.postgres.ports[5432] }}/usdr_grants_test"
+          # This is intentional to set POSTGRES_URL=POSTGRES_TEST_URL; ARPA Reporter test runner gates
+          # dev vs. CI differences based on whether these are the same.
+          POSTGRES_URL: "postgresql://postgres:password@localhost:${{ job.services.postgres.ports[5432] }}/usdr_grants_test"
+        run: yarn db:migrate
+      - name: Start Applications
+        env:
+          POSTGRES_TEST_URL: "postgresql://postgres:password@localhost:${{ job.services.postgres.ports[5432] }}/usdr_grants_test"
+          # This is intentional to set POSTGRES_URL=POSTGRES_TEST_URL; ARPA Reporter test runner gates
+          # dev vs. CI differences based on whether these are the same.
+          POSTGRES_URL: "postgresql://postgres:password@localhost:${{ job.services.postgres.ports[5432] }}/usdr_grants_test"
+          AWS_ACCESS_KEY_ID: "Fake AWS Key"
+          AWS_SECRET_ACCESS_KEY: "Fake AWS Secret"
+          NOTIFICATIONS_EMAIL: grants-identification@usdigitalresponse.org
+          DATA_DIR: './data'
+        run: yarn serve &
+      - name: Run e2e tests
+        uses: cypress-io/github-action@ebe8b24c4428922d0f793a5c4c96853a633180e3 # v6.6.0
+        env:
+          CYPRESS_BASE_URL: 'http://localhost:8080'
+        with:
+          publish-summary: true
+          working-directory: packages/e2e
+          wait-on: ${{ env.CYPRESS_BASE_URL }}
+
+  eslint:
+    name: Lint JavaScript
+    runs-on: ubuntu-latest
+    needs:
+      - prepare-qa
+    steps:
+      - uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        with:
+          disable-sudo: true
+          egress-policy: audit
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          ref: ${{ inputs.ref }}
+          show-progress: 'false'
+          persist-credentials: 'false'
+      - name: Setup Node
+        uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65 # v4.0.0
+        with:
+          node-version-file: .nvmrc
+          cache: yarn
+          cache-dependency-path: yarn.lock
+      - name: Install dependencies
+        run: yarn install -D --frozen-lockfile
+        env:
+          CI: "true"
+      - name: Run linter
+        run: yarn lint
+
+  tflint:
+    name: Lint terraform
+    runs-on: ubuntu-latest
+    steps:
+      - uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        with:
+          disable-sudo: true
+          egress-policy: audit
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          ref: ${{ inputs.ref }}
+          show-progress: 'false'
+          persist-credentials: 'false'
+      - uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
+        name: Cache plugin dir
+        with:
+          path: .tflint.d/plugins
+          key: ${{ runner.os }}-tflint-${{ hashFiles('terraform/.tflint.hcl') }}
+      - uses: terraform-linters/setup-tflint@19a52fbac37dacb22a09518e4ef6ee234f2d4987 # v4.0.0
+        name: Setup TFLint
+        with:
+          tflint_version: latest
+          tflint_wrapper: true
+      - name: Show TFLint version
+        run: tflint --version
+      - name: Init TFLint
+        run: tflint --init
+        working-directory: terraform
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+      - name: Run TFLint
+        run: tflint --format compact --recursive --minimum-failure-severity=error
diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml
new file mode 100644
index 000000000..cfbf08fd6
--- /dev/null
+++ b/.github/workflows/release-drafter.yml
@@ -0,0 +1,82 @@
+name: Release Drafter
+
+on:
+  push:
+    branches:
+      - main
+  pull_request_target:
+    types:
+      - opened
+      - synchronize
+      - reopened
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  label_pull_requests:
+    name: "Label pull requests"
+    if: github.event_name == 'pull_request' || github.event_name == 'pull_request_target'
+    permissions:
+      contents: read
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        with:
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
+      - name: "Run auto-labeler"
+        uses: release-drafter/release-drafter@09c613e259eb8d4e7c81c2cb00618eb5fc4575a7 # v5.25.0
+        with:
+          disable-releaser: true
+          disable-autolabeler: false
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  draft_release:
+    name: Create or update next release draft
+    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
+    permissions:
+      contents: write
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        with:
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          show-progress: false
+          persist-credentials: 'false'
+      - name: Get tag of "latest" release
+        id: latest_release
+        run: echo "tag=$(gh release view --json tagName --jq .tagName)" >> $GITHUB_OUTPUT
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: "Determine next release version"
+        id: next_release
+        run: |
+          chmod +x .github/next_release_version.bash
+          echo "version=$(bash .github/next_release_version.bash $LATEST_TAG)" >> $GITHUB_OUTPUT
+        env:
+          LATEST_TAG: ${{ steps.latest_release.outputs.tag || '' }}
+      - name: "Generate release notes and label pull requests"
+        uses: release-drafter/release-drafter@09c613e259eb8d4e7c81c2cb00618eb5fc4575a7 # v5.25.0
+        with:
+          version: ${{ steps.next_release.outputs.version }}
+          publish: false
+          disable-releaser: false
+          disable-autolabeler: false
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/select-target-environment.yml b/.github/workflows/select-target-environment.yml
deleted file mode 100644
index c98531a0b..000000000
--- a/.github/workflows/select-target-environment.yml
+++ /dev/null
@@ -1,36 +0,0 @@
-name: Select target environment
-
-on:
-  workflow_call:
-    inputs:
-      ref_name:
-        type: string
-        required: true
-    outputs:
-      selected:
-        description: Name of the environment to target
-        value: ${{ jobs.select.outputs.selected }}
-
-jobs:
-  select:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: kanga333/variable-mapper@master
-        with:
-          key: "${{ inputs.ref_name }}"
-          map: |
-            {
-              "_staging": {
-                "selected": "staging"
-              },
-              "main": {
-                "selected": "prod"
-              },
-              ".*": {
-                "selected": "sandbox"
-              }
-            }
-          export_to: log,env
-          mode: first_match
-    outputs:
-      selected: ${{ env.selected }}
diff --git a/.github/workflows/terraform-apply.yml b/.github/workflows/terraform-apply.yml
new file mode 100644
index 000000000..0692f788b
--- /dev/null
+++ b/.github/workflows/terraform-apply.yml
@@ -0,0 +1,140 @@
+name: Terraform Apply
+
+permissions:
+  contents: read
+
+on:
+  workflow_call:
+    inputs:
+      website-artifacts-key:
+        type: string
+        required: true
+      website-artifacts-path:
+        type: string
+        required: true
+      tf-plan-artifacts-key:
+        type: string
+        required: true
+      tf-backend-config-file:
+        type: string
+        required: true
+      aws-region:
+        type: string
+        required: true
+      environment-name:
+        type: string
+        required: true
+      concurrency-group:
+        description: Name of the concurrency group (avoids simultaneous Terraform execution against the same environment)
+        type: string
+        default: run_terraform
+    secrets:
+      aws-access-key-id:
+        required: true
+      aws-secret-access-key:
+        required: true
+      aws-session-token:
+        required: true
+      datadog-api-key:
+        required: true
+      datadog-app-key:
+        required: true
+      gpg-passphrase:
+        required: true
+
+jobs:
+  do:
+    name: Apply Terraform from Plan
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: terraform
+    env:
+      AWS_DEFAULT_REGION: ${{ inputs.aws-region }}
+      AWS_REGION: ${{ inputs.aws-region }}
+      TF_CLI_ARGS: "-no-color"
+      TF_IN_AUTOMATION: "true"
+      TF_INPUT: 0
+      TF_PLUGIN_CACHE_DIR: ~/.terraform.d/plugin-cache
+    environment: ${{ inputs.environment-name }}
+    concurrency:
+      group: ${{ inputs.concurrency-group }}
+      cancel-in-progress: false
+    steps:
+      - uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        with:
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            *.amazonaws.com:443
+            actions-results-receiver-production.githubapp.com:443
+            api.datadoghq.com:443
+            checkpoint-api.hashicorp.com:443
+            github.com:443
+            objects.githubusercontent.com:443
+            registry.terraform.io:443
+            releases.hashicorp.com:443
+      - name: Download Terraform artifacts
+        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
+        with:
+          name: ${{ inputs.tf-plan-artifacts-key }}
+          path: ${{ github.workspace }}/terraform
+      - name: Clear any cached provider plugins in artifact
+        run: rm -rf "$TF_PLUGIN_CACHE_DIR"
+      - name: Get project TF version
+        id: get_tf_version
+        run: echo "TF_VERSION=$(cat .terraform-version | tr -d '[:space:]')" | tee -a $GITHUB_OUTPUT
+      - uses: hashicorp/setup-terraform@a1502cd9e758c50496cc9ac5308c4843bcd56d36 # v3.0.0
+        with:
+          terraform_version: ${{ steps.get_tf_version.outputs.TF_VERSION }}
+      - name: Download website artifacts
+        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
+        with:
+          name: ${{ inputs.website-artifacts-key }}
+          path: ${{ inputs.website-artifacts-path }}
+      - name: Decrypt plan file
+        run: gpg -qd --batch --yes --passphrase "$GPG_PASSPHRASE" -o tfplan tfplan.gpg
+        env:
+          GPG_PASSPHRASE: ${{ secrets.gpg-passphrase }}
+      - name: Get AWS access key ID
+        id: decrypt-aws-access-key-id
+        run: |
+          decrypted=$(gpg -qd --batch --yes --passphrase "$GPG_PASSPHRASE" -o - <(echo "$VALUE" | base64 -d))
+          echo "::add-mask::${decrypted}"
+          echo "out=${decrypted}" >> $GITHUB_OUTPUT
+        env:
+          GPG_PASSPHRASE: ${{ secrets.gpg-passphrase }}
+          VALUE: ${{ secrets.aws-access-key-id }}
+      - name: Get AWS secret access key
+        id: decrypt-aws-secret-access-key
+        run: |
+          decrypted=$(gpg -qd --batch --yes --passphrase "$GPG_PASSPHRASE" -o - <(echo "$VALUE" | base64 -d))
+          echo "::add-mask::${decrypted}"
+          echo "out=${decrypted}" >> $GITHUB_OUTPUT
+        env:
+          GPG_PASSPHRASE: ${{ secrets.gpg-passphrase }}
+          VALUE: ${{ secrets.aws-secret-access-key }}
+      - name: Get AWS session token
+        id: decrypt-aws-session-token
+        run: |
+          decrypted=$(gpg -qd --batch --yes --passphrase "$GPG_PASSPHRASE" -o - <(echo "$VALUE" | base64 -d))
+          echo "::add-mask::${decrypted}"
+          echo "out=${decrypted}" >> $GITHUB_OUTPUT
+        env:
+          GPG_PASSPHRASE: ${{ secrets.gpg-passphrase }}
+          VALUE: ${{ secrets.aws-session-token }}
+      - name: Terraform Init
+        run: terraform init
+        env:
+          AWS_ACCESS_KEY_ID: "${{ steps.decrypt-aws-access-key-id.outputs.out }}"
+          AWS_SECRET_ACCESS_KEY: "${{ steps.decrypt-aws-secret-access-key.outputs.out }}"
+          AWS_SESSION_TOKEN: "${{ steps.decrypt-aws-session-token.outputs.out }}"
+          TF_CLI_ARGS_init: "-backend-config=${{ inputs.tf-backend-config-file }}"
+      - name: Terraform Apply
+        run: terraform apply tfplan
+        env:
+          AWS_ACCESS_KEY_ID: "${{ steps.decrypt-aws-access-key-id.outputs.out }}"
+          AWS_SECRET_ACCESS_KEY: "${{ steps.decrypt-aws-secret-access-key.outputs.out }}"
+          AWS_SESSION_TOKEN: "${{ steps.decrypt-aws-session-token.outputs.out }}"
diff --git a/.github/workflows/terraform-ci.yml b/.github/workflows/terraform-ci.yml
deleted file mode 100644
index feb619f28..000000000
--- a/.github/workflows/terraform-ci.yml
+++ /dev/null
@@ -1,153 +0,0 @@
-name: Terraform CI
-
-on:
-  pull_request:
-    paths:
-      - 'terraform/**'
-      - '.github/workflows/terraform-ci.yml'
-
-permissions:
-  pull-requests: write
-  contents: read
-  id-token: write
-
-concurrency:
-  group: ${{ github.workflow_ref }}
-
-jobs:
-  lint:
-    name: Lint terraform
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v3
-      - uses: hashicorp/setup-terraform@v2
-      - name: Terraform fmt
-        id: fmt
-        run: terraform fmt -check -diff -recursive ./terraform
-
-  select_target_environment:
-    uses: "./.github/workflows/select-target-environment.yml"
-    with:
-      ref_name: "${{ github.base_ref }}"
-
-  validate_plan_report:
-    name: Validate and plan terraform
-    runs-on: ubuntu-latest
-    needs:
-      - lint
-      - select_target_environment
-    environment: ${{ needs.select_target_environment.outputs.selected }}
-    env:
-      TF_PLUGIN_CACHE_DIR: ~/.terraform.d/plugin-cache
-      TF_VAR_version_identifier: ${{ github.sha }}
-      TF_VAR_datadog_api_key: ${{ secrets.DATADOG_API_KEY }}
-      TF_VAR_datadog_app_key: ${{ secrets.DATADOG_APP_KEY }}
-    concurrency:
-      group: run_terraform-${{ needs.select_target_environment.outputs.selected }}
-    steps:
-      - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v1
-        with:
-          aws-region: us-west-2
-          role-to-assume: "${{ secrets.AWS_ROLE_TO_ASSUME }}"
-      - name: Checkout Repo
-        uses: actions/checkout@v3
-      - name: Get project TF version
-        id: get_version
-        run: echo "TF_VERSION=$(cat .terraform-version | tr -d '[:space:]')" | tee -a $GITHUB_OUTPUT
-        working-directory: terraform
-      - uses: hashicorp/setup-terraform@v2
-        with:
-          terraform_version: ${{ steps.get_version.outputs.TF_VERSION }}
-      - name: Ensure Terraform plugin cache exists
-        run: mkdir -p $TF_PLUGIN_CACHE_DIR
-      - name: Save/Restore Terraform plugin cache
-        uses: actions/cache@v3
-        with:
-          path: ${{ env.TF_PLUGIN_CACHE_DIR }}
-          key: ${{ runner.os }}-terraform-${{ hashFiles('**/.terraform.lock.hcl') }}
-          restore-keys: |
-            ${{ runner.os }}-terraform-
-      - name: Ensure Terraform plugin cache still exists
-        run: mkdir -p $TF_PLUGIN_CACHE_DIR
-      - name: Terraform Init
-        id: init
-        run: terraform init -backend-config="${{ needs.select_target_environment.outputs.selected }}.s3.tfbackend"
-        working-directory: terraform
-      - name: Terraform Validate
-        id: validate
-        run: terraform validate -no-color
-        working-directory: terraform
-      - name: Terraform Plan
-        if: steps.validate.outcome == 'success'
-        id: plan
-        run: terraform plan -input=false -no-color -out=tfplan -var-file="${{ needs.select_target_environment.outputs.selected }}.tfvars" && terraform show -no-color tfplan
-        working-directory: terraform
-      - name: Reformat Plan
-        if: steps.plan.outcome != 'cancelled' && steps.plan.outcome != 'skipped'
-        run: |
-          echo '${{ steps.plan.outputs.stdout || steps.plan.outputs.stderr }}' \
-          | sed -E 's/^([[:space:]]+)([-+])/\2\1/g' > plan.txt
-      - name: Put Plan in Env Var
-        if: steps.plan.outcome != 'cancelled' && steps.plan.outcome != 'skipped'
-        run: |
-          PLAN=$(cat plan.txt)
-          echo "PLAN<<EOF" >> $GITHUB_ENV
-          echo "$PLAN" >> $GITHUB_ENV
-          echo "EOF" >> $GITHUB_ENV
-      - uses: actions/github-script@v6
-        if: github.event_name == 'pull_request'
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            // 1. Retrieve existing bot comments for the PR
-            const { data: comments } = await github.rest.issues.listComments({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-            })
-            const botComment = comments.find(comment => {
-              return comment.user.type === 'Bot' && comment.body.includes('Report for project: \`terraform\`')
-            })
-
-            // 2. Prepare format of the comment
-            const output = `### Report for project: \`terraform\`
-            #### Terraform Initialization ⚙️\`${{ steps.init.outcome }}\`
-            #### Terraform Validation 🤖\`${{ steps.validate.outcome }}\`
-            <details><summary>Validation Output</summary>
-
-            \`\`\`\n
-            ${{ steps.validate.outputs.stdout }}
-            \`\`\`
-
-            </details>
-
-            #### Terraform Plan 📖\`${{ steps.plan.outcome }}\`
-
-            <details><summary>Show Plan</summary>
-
-            \`\`\`diff\n
-            ${process.env.PLAN}
-            \`\`\`
-
-            </details>
-
-            *Pusher: @${{ github.actor }}, Action: \`${{ github.event_name }}\`, Workflow: \`${{ github.workflow }}\`*`;
-
-            // 3. If we have a comment, update it, otherwise create a new one
-            if (botComment) {
-              github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: botComment.id,
-                body: output
-              })
-            } else {
-              github.rest.issues.createComment({
-                issue_number: context.issue.number,
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                body: output
-              })
-            }
diff --git a/.github/workflows/terraform-plan.yml b/.github/workflows/terraform-plan.yml
new file mode 100644
index 000000000..10f084047
--- /dev/null
+++ b/.github/workflows/terraform-plan.yml
@@ -0,0 +1,211 @@
+name: Terraform Plan
+
+permissions:
+  contents: read
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        type: string
+        required: true
+      environment-key:
+        type: string
+        required: true
+      aws-region:
+        type: string
+        required: true
+      tf-backend-config-file:
+        type: string
+        required: true
+      tf-var-file:
+        type: string
+        required: true
+      artifacts-retention-days:
+        description: Number of days to retain build artifacts
+        type: number
+        default: 90
+      upload-artifacts:
+        type: boolean
+        default: false
+      concurrency-group:
+        description: Name of the concurrency group (avoids simultaneous Terraform execution against the same environment)
+        type: string
+        default: run_terraform
+      server-image-tag:
+        type: string
+        required: true
+      server-image-digest:
+        type: string
+        required: true
+      website-artifacts-key:
+        type: string
+        required: true
+      website-artifacts-path:
+        type: string
+        required: true
+    secrets:
+      aws-access-key-id:
+        required: true
+      aws-secret-access-key:
+        required: true
+      aws-session-token:
+        required: true
+      datadog-api-key:
+        required: true
+      datadog-app-key:
+        required: true
+      gpg-passphrase:
+        required: true
+    outputs:
+      artifacts-key:
+        value: ${{ jobs.do.outputs.artifacts-key }}
+      fmt-outcome:
+        value: ${{ jobs.do.outputs.fmt_outcome }}
+      init-outcome:
+        value: ${{ jobs.do.outputs.init_outcome }}
+      validate-outcome:
+        value: ${{ jobs.do.outputs.validate_outcome }}
+      validate-output:
+        value: ${{ jobs.do.outputs.validate_output }}
+      plan-exitcode:
+        value: ${{ jobs.do.outputs.plan_exitcode }}
+      plan-outcome:
+        value: ${{ jobs.do.outputs.plan_outcome }}
+      plan-output:
+        value: ${{ jobs.do.outputs.plan_output }}
+
+jobs:
+  do:
+    name: Validate and plan terraform
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: terraform
+    outputs:
+      artifacts-key: ${{ env.ARTIFACTS_KEY }}
+      fmt_outcome: ${{ steps.fmt.outcome }}
+      init_outcome: ${{ steps.init.outcome }}
+      validate_outcome: ${{ steps.validate.outcome }}
+      validate_output: ${{ steps.validate.outputs.stdout }}
+      plan_exitcode: ${{ steps.plan.outputs.exitcode }}
+      plan_outcome: ${{ steps.plan.outcome }}
+      plan_output: ${{ steps.show_plan.outputs.stdout || steps.show_plan.outputs.stderr }}
+    env:
+      ARTIFACTS_KEY: terraform-${{ inputs.environment-key }}-${{ inputs.ref }}
+      AWS_DEFAULT_REGION: ${{ inputs.aws-region }}
+      AWS_REGION: ${{ inputs.aws-region }}
+      TF_CLI_ARGS: "-no-color"
+      TF_IN_AUTOMATION: "true"
+      TF_INPUT: 0
+    concurrency:
+      group: ${{ inputs.concurrency-group }}
+      cancel-in-progress: false
+    steps:
+      - uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        with:
+          disable-sudo: true
+          egress-policy: audit
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          ref: ${{ inputs.ref }}
+          show-progress: 'false'
+          persist-credentials: 'false'
+      - name: Validate workflow configuration
+        if: inputs.upload-artifacts && (env.GPG_PASSPHRASE == '')
+        run: |
+          echo 'gpg-passphrase is required when upload-artifacts is true'
+          exit 1
+        env:
+          GPG_PASSPHRASE: ${{ secrets.gpg-passphrase }}
+      - name: Download website artifacts
+        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
+        with:
+          name: ${{ inputs.website-artifacts-key }}
+          path: ${{ inputs.website-artifacts-path }}
+      - name: Get project TF version
+        id: get_tf_version
+        run: echo "TF_VERSION=$(cat .terraform-version | tr -d '[:space:]')" | tee -a $GITHUB_OUTPUT
+      - uses: hashicorp/setup-terraform@a1502cd9e758c50496cc9ac5308c4843bcd56d36 # v3.0.0
+        with:
+          terraform_version: ${{ steps.get_tf_version.outputs.TF_VERSION }}
+      - name: Terraform fmt
+        id: fmt
+        run: terraform fmt -check -diff -recursive
+      - name: Get AWS access key ID
+        id: decrypt-aws-access-key-id
+        run: |
+          decrypted=$(gpg -qd --batch --yes --passphrase "$GPG_PASSPHRASE" -o - <(echo "$VALUE" | base64 -d))
+          echo "::add-mask::${decrypted}"
+          echo "out=${decrypted}" >> $GITHUB_OUTPUT
+        env:
+          GPG_PASSPHRASE: ${{ secrets.gpg-passphrase }}
+          VALUE: ${{ secrets.aws-access-key-id }}
+      - name: Get AWS secret access key
+        id: decrypt-aws-secret-access-key
+        run: |
+          decrypted=$(gpg -qd --batch --yes --passphrase "$GPG_PASSPHRASE" -o - <(echo "$VALUE" | base64 -d))
+          echo "::add-mask::${decrypted}"
+          echo "out=${decrypted}" >> $GITHUB_OUTPUT
+        env:
+          GPG_PASSPHRASE: ${{ secrets.gpg-passphrase }}
+          VALUE: ${{ secrets.aws-secret-access-key }}
+      - name: Get AWS session token
+        id: decrypt-aws-session-token
+        run: |
+          decrypted=$(gpg -qd --batch --yes --passphrase "$GPG_PASSPHRASE" -o - <(echo "$VALUE" | base64 -d))
+          echo "::add-mask::${decrypted}"
+          echo "out=${decrypted}" >> $GITHUB_OUTPUT
+        env:
+          GPG_PASSPHRASE: ${{ secrets.gpg-passphrase }}
+          VALUE: ${{ secrets.aws-session-token }}
+      - name: Terraform Init
+        id: init
+        run: terraform init
+        env:
+          AWS_ACCESS_KEY_ID: "${{ steps.decrypt-aws-access-key-id.outputs.out }}"
+          AWS_SECRET_ACCESS_KEY: "${{ steps.decrypt-aws-secret-access-key.outputs.out }}"
+          AWS_SESSION_TOKEN: "${{ steps.decrypt-aws-session-token.outputs.out }}"
+          TF_CLI_ARGS_init: "-backend-config=${{ inputs.tf-backend-config-file }}"
+      - name: Terraform Validate
+        id: validate
+        run: terraform validate -no-color
+      - name: Terraform Plan
+        if: always() && steps.validate.outcome == 'success'
+        id: plan
+        run: terraform plan -out="tfplan" -detailed-exitcode
+        env:
+          AWS_ACCESS_KEY_ID: "${{ steps.decrypt-aws-access-key-id.outputs.out }}"
+          AWS_SECRET_ACCESS_KEY: "${{ steps.decrypt-aws-secret-access-key.outputs.out }}"
+          AWS_SESSION_TOKEN: "${{ steps.decrypt-aws-session-token.outputs.out }}"
+          GPG_PASSPHRASE: "" # Just in case
+          TF_CLI_ARGS_plan: "-var-file=${{ inputs.tf-var-file }}"
+          TF_VAR_version_identifier: ${{ inputs.ref }}
+          TF_VAR_git_commit_sha: ${{ inputs.ref }}
+          TF_VAR_datadog_api_key: ${{ secrets.datadog-api-key }}
+          TF_VAR_datadog_app_key: ${{ secrets.datadog-app-key }}
+          TF_VAR_api_container_image_tag: "${{ inputs.server-image-tag }}@${{ inputs.server-image-digest }}"
+          TF_VAR_website_origin_artifacts_dist_path: "${{ inputs.website-artifacts-path }}"
+      - name: Generate plaintext plan
+        id: show_plan
+        run: terraform show tfplan
+      - name: Encrypt terraform plan file
+        id: encrypt_plan
+        if: success() && inputs.upload-artifacts
+        env:
+          GPG_PASSPHRASE: ${{ secrets.gpg-passphrase }}
+        run: |
+          gpg --batch --yes --passphrase "$GPG_PASSPHRASE" -c --cipher-algo AES256 tfplan
+          rm tfplan
+      - name: Store terraform artifacts
+        if: success() && inputs.upload-artifacts
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
+        with:
+          name: ${{ env.ARTIFACTS_KEY }}
+          path: |
+            ${{ github.workspace }}/terraform
+            !${{ github.workspace }}/terraform/.terraform
+          if-no-files-found: error
+          retention-days: ${{ inputs.artifacts-retention-days }}
diff --git a/.github/workflows/validate-deployment.yml b/.github/workflows/validate-deployment.yml
new file mode 100644
index 000000000..6ee042860
--- /dev/null
+++ b/.github/workflows/validate-deployment.yml
@@ -0,0 +1,76 @@
+name: Validate commits for deployment
+
+permissions:
+  contents: read
+
+on:
+  workflow_call:
+    inputs:
+      protected-ref:
+        type: string
+        required: true
+      deployment-ref:
+        type: string
+        required: true
+    outputs:
+      valid:
+        value: ${{ jobs.validate.result == 'skipped' || jobs.validate.result == 'success' }}
+  workflow_dispatch:
+    inputs:
+      protected-ref:
+        type: string
+        required: true
+      deployment-ref:
+        type: string
+        required: true
+
+jobs:
+  validate:
+    name: Validate
+    runs-on: ubuntu-latest
+    if: inputs.deployment-ref != inputs.protected-ref
+    env:
+      PROTECTED_REF: ${{ inputs.protected-ref }}
+      DEPLOYMENT_REF: ${{ inputs.deployment-ref }}
+    steps:
+      - uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
+        with:
+          disable-sudo: true
+          egress-policy: audit
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          ref: ${{ env.PROTECTED_REF }}
+          show-progress: 'false'
+          persist-credentials: 'false'
+      - name: Count commits in candidate ref that are not in protected ref
+        id: all-cherries
+        run: |
+          CHERRY_FILE=$(mktemp -t cherries.XXXXX)
+          git cherry -v "$PROTECTED_REF" "$DEPLOYMENT_REF" > $CHERRY_FILE
+          echo "count=$(cat $CHERRY_FILE | wc -l)" >> $GITHUB_OUTPUT
+          echo "file=$CHERRY_FILE" >> $GITHUB_OUTPUT
+      - name: Count commits that were not cherry-picked from protected ref
+        id: missing-cherries
+        run: echo "count=$(cat $CHERRY_FILE | grep -E '^[+]' | wc -l)" >> $GITHUB_OUTPUT
+        env:
+          CHERRY_FILE: ${{ steps.all-cherries.outputs.file }}
+      - name: Report outcome to step summary
+        run: |
+          echo "Result: $VALIDATION_RESULT" >> $GITHUB_STEP_SUMMARY
+          echo "Found $TOTAL_CHERRY_COUNT commits in $DEPLOYMENT_REF not in $PROTECTED_REF." >> $GITHUB_STEP_SUMMARY
+          echo "Of these, $INVALID_CHERRY_COUNT were not cherry-picked from $PROTECTED_REF." >> $GITHUB_STEP_SUMMARY
+          echo "Only commits from pull requests that were approved and merged to $PROTECTED_REF are eligible for deployment." >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          cat "$CHERRY_FILE" >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+        env:
+          VALIDATION_RESULT: ${{ fromJson(steps.missing-cherries.outputs.count) == 0 && 'SUCCESS' || 'FAIL' }}
+          TOTAL_CHERRY_COUNT: ${{ steps.all-cherries.outputs.count }}
+          INVALID_CHERRY_COUNT: ${{ steps.missing-cherries.outputs.count }}
+          CHERRY_FILE: ${{ steps.all-cherries.outputs.file }}
+      - name: Fail validation
+        if: fromJson(steps.missing-cherries.outputs.count) > 0
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          script: |
+            core.setFailed('Invalid commits detected')
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 746cadee5..6f21b8fb2 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,140 +1,101 @@
 # How to contribute to U.S. Digital Response projects
 
-Everyone is welcome to contribute, and we value everybody's contribution. Code
-is not the only way to help the community. Answering questions, helping
-others, reaching out, and improving the documentation are all immensely valuable
-to the community.
+Everyone is welcome to contribute, and we value everybody's contribution.
+Code is not the only way to help the community.
+Answering questions, helping others, reaching out, and improving documentation are all immensely valuable to the community.
 
 
 ## You can contribute in so many ways!
 
-There are 3 ways you can contribute to this project:
+There are several ways you can contribute to this repository:
 
-- Fixing outstanding issues with the existing code;
-- Contributing to the examples or to the documentation;
-- Submitting issues related to bugs or desired new features.
+- Enhancing and/or fixing outstanding issues with the existing code
+- Contributing useful improvements, clarifications, and updates to existing documentation
+- Submitting [issues](https://github.com/usdigitalresponse/usdr-gost/issues/new/choose) related to bugs or desired new features
+- Reporting security vulnerabilities
 
 _All are equally valuable to the community._
 
-We also onboard new volunteers to USDR projects in general at [https://www.usdigitalresponse.org/raisingyourhand](https://www.usdigitalresponse.org/raisingyourhand). Please sign up if you’d like to help on other projects.
+We also onboard new volunteers to USDR projects in general at https://www.usdigitalresponse.org/volunteer.
+Please sign up if you’d like to help on other projects.
 
 
 ## Submitting a new issue or feature request
 
-Do your best to follow these guidelines when submitting an issue or a feature
-request. It will make it easier for us to come back to you quickly and with good
-feedback.
+Do your best to follow these guidelines when submitting an issue or a feature request.
+It will make it easier for us to come back to you quickly and with good feedback.
 
+First, please check whether your issue or feature request has already been submitted by searching our [open issues](https://github.com/usdigitalresponse/usdr-gost/issues?q=is%3Aopen+is%3Aissue).
 
-### Did you find a bug?
 
-Open source code is robust and reliable thanks to the users who notify us of
-the problems they encounter, so thank you for reporting an issue.
+### Bugs
 
-First, we would really appreciate it if you could **make sure the bug was not
-already reported** (use the search bar on GitHub under the “Issues” tab).
+If you find an [open bug](https://github.com/usdigitalresponse/usdr-gost/issues?q=is%3Aopen+is%3Aissue+label%3Abug) that sounds like your issue, please consider adding a comment to the existing issue with details that will help us better understand the problem.
 
-Did not find it? :( So we can act quickly on it, please include the following:
+To submit something new, please fill out and submit [this form](https://github.com/usdigitalresponse/usdr-gost/issues/new?template=default_issue.yml&title=%5BBug%5D%3A+).
 
-- Your **operating system**.
-- If the problem is with the API, your **client (e.g. cURL, Python Requests)**.
-- If the problem was with the demo UI or docs pages, your **browser (e.g. Firefox, Chrome, Edge, Internet Explorer)**.
-- Any code errors that you have access to.
 
+### Security vulnerabilities
 
-### Do you want a new feature?
+Please fill out and submit [this form](https://github.com/usdigitalresponse/usdr-gost/security/advisories/new)
+if you believe you have discovered a security-related problem.
 
-A world-class feature request addresses the following points:
-
-1. Motivation first:
-
-- Is it related to a problem/frustration with the current system? If so, please explain why.
-- Is it related to something you would need for a project? We'd love to hear about it!
-- Is it something you worked on and think could benefit the community? Awesome! Tell us what problem it solved for you.
 
-2. Write a _full paragraph_ describing the feature;
-3. Provide a **code snippet** or **design mockup or sketch** if possible, to demonstrate its future use.
+### New features
 
-If your issue is well written, we’re already 80% of the way there by the time you
-post it.
-
-
-## Start contributing! (Pull Requests)
-
-Before writing code, we strongly advise you to search through the exising PRs or
-issues to make sure that nobody is already working on the same thing. If you are
-unsure, it is always a good idea to open an issue to get some feedback.
+A world-class feature request addresses the following points:
 
-You will need basic `git` proficiency to be able to contribute to
-this project. `git` is not the easiest tool to use but it has the greatest
-manual. Type `git --help` in a shell and enjoy.
+1. Motivation first:
+    - Is it related to a problem/frustration with the current system? If so, ease explain why.
+    - Is it related to something you would need for a project? We'd love to hear about it!
+    - Is it something you worked on and think could benefit the community?
+    Awesome!
+    Tell us what problem it solved for you.
+    - Do you think you have a neat idea and want to share it?
+    We love those too!
+    Tell us your use-case and what value it might bring to the project.
+2. Write a _full paragraph_ describing why you think the feature is important.
+3. Provide a **code snippet** or **design mockup or sketch** if possible, to demonstrate its
+future use.
+
+By the way, your suggestions do not need to be restricted to changes to how this project works in a production environment!
+We would love to hear your ideas for improving all types of things, including:
+- Ways to enhance the developer experience.
+- Testing and other maintainability strategies.
+- Automated CI/CD workflows.
+
+
+## Start contributing! (pull requests)
+
+Before writing code, we strongly advise you to search through the existing PRs or issues to make sure that nobody is already working on the same thing.
+If you are unsure, it is always a good idea to open an issue to get some feedback.
+
+Things you will need:
+- Basic `git` proficiency.
+- Knowledge of one or more of the languages used in this project, such as JavaScript and/or Terraform.
+- A development environment.
+See the [Development](https://github.com/usdigitalresponse/usdr-gost/blob/main/README.md#development) section of our README for more information.
+- A positive attitude.
 
 Follow these steps to start contributing:
 
-1. Fork the repository by
-   clicking on the 'Fork' button on the repository's page. This creates a copy of the code
-   under your GitHub user account.
-
-2. Clone your fork to your local disk
-
-3. Create a new branch to hold your development changes:
-
-   ```bash
-   $ git checkout -b a-descriptive-name-for-my-changes
-   ```
-
-   please avoid working on the `main` or `gh-pages` branch directly.
-
-4. Develop the features on your branch.
-
-   Once you're happy with your changes, add changed files using `git add` and
-   make a commit with `git commit` to record your changes locally:
-
-   ```bash
-   $ git add modified_file.py
-   $ git commit
-   ```
-
-   Commit messages must follow the [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) style. 
-
-   It is a good idea to sync your copy of the code with the original
-   repository regularly. This way you can quickly account for changes:
-
-   ```bash
-   $ git fetch origin
-   $ git rebase origin/_staging
-   ```
-
-   Push the changes to your account using:
-
-   ```bash
-   $ git push -u origin a-descriptive-name-for-my-changes
-   ```
-
-5. Once you are satisfied (**and the checklist below is happy, too**), go to the
-   webpage of your fork on GitHub. Click on 'Pull request' to send your changes
-   to the project maintainers for review.
-
-6. It's ok if maintainers ask you for changes. It happens to core contributors
-   too! So everyone can see the changes in the Pull request, work in your local
-   branch and push the changes to your fork. They will automatically appear in
-   the pull request.
-
-
-### Checklist
-
-1. The title of your pull request should be a summary of its contribution;
-
-2. If your pull request adresses an issue, please [mention the issue number in
-   the pull request description to make sure they are linked](https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue#linking-a-pull-request-to-an-issue-using-a-keyword) (and so people consulting the issue know you are working on it);
-
-3. To indicate a work in progress, please submit your pull request as a draft.
-   This is useful to avoid duplicated work, and to differentiate it from PRs
-   ready to be merged.
-
-   ![Creating a draft pull request](./docs/_assets/draft-pr.png)
-
-4. If there are any tests, make sure that they pass and cover your new features and bugfixes.
-
-
-#### This guide was based on [HuggingFace/transformers](https://github.com/huggingface/transformers/blob/master/CONTRIBUTING.md) which was itself based on [SciKit-Learn](https://github.com/scikit-learn/scikit-learn/blob/master/CONTRIBUTING.md)
+1. Fork the repository by clicking on the 'Fork' button on the repository's page.
+This creates a copy of the code under your GitHub user account.
+    - **Note:** If you are an active volunteer with contributor access to this repository,
+    you may alternatively clone and make branches against this repository directly.
+2. Clone your fork to your development environment.
+3. Create a new branch to hold your development changes.
+We recommend that you use the following conventions when naming your branch:
+    | **Branch Prefix** | **Type of Contribution**                                               | **Example**                         |
+    |-------------------|------------------------------------------------------------------------|-------------------------------------|
+    | `feat/`           | New features and enhancements.                                         | `feat/generate-jetpacks`            |
+    | `bug/` or `fix/`  | Changes that resolve or mitigate a problem.                            | `fix/jetpack-fuel-gauge-inaccuracy` |
+    | `docs/`           | Improvements, clarifications, and/or updates to existing documentation | `docs/clarify-landing-instructions` |
+
+4. Develop, commit, and push the features on your branch.
+5. Once you are satisfied, submit your pull request!
+    - Make sure the title of your PR represents a short summary of the contribution.
+    - Fill out the different sections that appear in the pull request template.
+    - Please include unit tests for all JavaScript code!
+    - If your work isn't quite ready but you want early feedback, submit your pull request as a draft.
+6. Don't worry if maintainers ask you for changes - it's all part of the collaborative process!
diff --git a/README.md b/README.md
index e1e6d1781..acbb5a0f9 100644
--- a/README.md
+++ b/README.md
@@ -35,6 +35,13 @@ This repository falls under [U.S. Digital Response’s Code of Conduct](./CODE_O
 
 This project wouldn’t exist without the hard work of many people. Please see [`CONTRIBUTING.md`](./CONTRIBUTING.md) to find out how you can help.
 
+## Release Management
+
+Releases are versioned using a `YYYY.inc` scheme that represents the year of the release, and the incremental release number for that year.
+You can view a list of all historical releases on the [Releases page](https://github.com/usdigitalresponse/usdr-gost/releases).
+
+For details on deploying releases to Production, see our [Release Process](./docs/releasing.md) documentation.
+
 ## License & Copyright
 
 Copyright (C) 2020-2021 U.S. Digital Response (USDR)
diff --git a/docs/deployment.md b/docs/deployment.md
deleted file mode 100644
index a950eb168..000000000
--- a/docs/deployment.md
+++ /dev/null
@@ -1,64 +0,0 @@
-# Deployment
-
-(Note, as of Mar 12, 2023, information in this file needs updating to account for the new AWS-based deployment process)
-
-## Render
-
-1. Create web service
-
-   ![create-web-service](./img/create-web-service.png)
-
-2. Create database
-
-   ![create-database](./img/create-database.png)
-
-3. Update web service environment variables
-
-   ![update-web-env-vars](./img/update-web-env-vars.png)
-
-   **NOTE:** Don't set `NODE_ENV=production` else NPM dev deps will not be installed and prod deployments will fail [(source)](https://github.com/vuejs/vue-cli/issues/5107#issuecomment-586701382)
-
-   ![prod-env-error](./img/prod-env-error.png)
-
-   ```sh
-   POSTGRES_URL=<POSTGRE_CONNECTION_STRING> # Render Internal connection string ie postgres://cares_opportunity_user:<pass>@<domain>/cares_opportunity_1e53
-
-   COOKIE_SECRET=<RANDOM_ALPHANUMERIC_SECRET>
-
-   WEBSITE_DOMAIN=<WEB_SERVICE_URL> # Render web service url ie. https://cares-grant-opportunities-qi8i.onrender.com
-
-   NODE_ENV=development or production or test
-
-   NOTIFICATIONS_EMAIL="grants-identification@usdigitalresponse.org"
-   AWS_ACCESS_KEY_ID=<AWS_ACCESS_KEY_ID>
-   AWS_SECRET_ACCESS_KEY=<AWS_SECRET_ACCESS_KEY>
-
-   ENABLE_GRANTS_SCRAPER=true
-   GRANTS_SCRAPER_DATE_RANGE=7 # date range of grants that will be scraped
-   GRANTS_SCRAPER_DELAY=1000 # delay in milliseconds for scraper
-
-   NODE_OPTIONS=--max_old_space_size=1024 # increase node max memory, had problems with node not using all of renders server memory. This will depend on the plan
-   ```
-
-## DB Migrations
-
-1. Get the postgres external connection string from render. Set it as an environment variable
-
-   `export POSTGRES_URL="postgres://user:{pass}@{domain}/{db}?ssl=true"`
-
-   NOTE: must add `?ssl=true`
-
-1. Change directory to packages/server
-
-1. Update seeds/dev files accordingly
-   - seeds/dev/ref/agencies.js - list of agencies to be created. You can update this with the state provided agency. Note: We add a special USDR agency for our accounts in the system
-   - seeds/dev/index.js - Update the admin list variable accordingly
-
-1. Run the following commands
-
-   ```sh
-   npx knex migrate:latest
-   npx knex seed:run
-   ```
-
-   After that you should be able to access the site and login with the users set in the migration.
diff --git a/docs/development.md b/docs/development.md
index 396eb7700..6b7beb771 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -60,7 +60,7 @@ See [here](../docker/README.md) for more information about commands to use when
 
    ![AWS SES Error](./img/error-aws-ses.png)
 
-1. Visit `client_url/login` (e.g <http://localhost:8080/#/login>) and login w/ user `grant-admin@usdigitalresponse.org`.
+1. Visit `client_url/login` (e.g <http://localhost:8080/#/login>) and login w/ user `grant-admin@usdigitalresponse.org`. You'll see a confirmation message on the screen. Check your logs to find the generated session link.
 
    **NOTE:** if you only see a blank screen then ensure you've set up the `packages/client/.env`
 
diff --git a/docs/getting-started.md b/docs/getting-started.md
index 4cbaa4636..62106ef4c 100644
--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -21,10 +21,11 @@ Find instructions for using Docker-compose to do local development [here](../doc
 
 - For Mac/Linux, see [here](./setup-mac.md)
 - For Windows, see [here](./setup-windows.md)
+  - Note: these instructions also use Docker
 
 ## Development
 
-See [here](./development.md) for more information about setting up local development
+See [here](./development.md) for more information on setting up for development with Docker or with a local environment. Includes details on running code, linting, debugging and styling.
 
 ## Common Tasks
 
diff --git a/docs/img/setup-windows-docker-integration.png b/docs/img/setup-windows-docker-integration.png
new file mode 100644
index 000000000..1458dc17b
Binary files /dev/null and b/docs/img/setup-windows-docker-integration.png differ
diff --git a/docs/img/setup-windows-linux-files.png b/docs/img/setup-windows-linux-files.png
new file mode 100644
index 000000000..8b40b1b8a
Binary files /dev/null and b/docs/img/setup-windows-linux-files.png differ
diff --git a/docs/img/setup-windows-linux-path.png b/docs/img/setup-windows-linux-path.png
new file mode 100644
index 000000000..0ed453d4c
Binary files /dev/null and b/docs/img/setup-windows-linux-path.png differ
diff --git a/docs/img/setup-windows-wsl-connect.png b/docs/img/setup-windows-wsl-connect.png
new file mode 100644
index 000000000..255c10713
Binary files /dev/null and b/docs/img/setup-windows-wsl-connect.png differ
diff --git a/docs/img/setup-windows-wsl-running.png b/docs/img/setup-windows-wsl-running.png
new file mode 100644
index 000000000..ee6063c3e
Binary files /dev/null and b/docs/img/setup-windows-wsl-running.png differ
diff --git a/docs/releasing.md b/docs/releasing.md
new file mode 100644
index 000000000..cff98c2f9
--- /dev/null
+++ b/docs/releasing.md
@@ -0,0 +1,174 @@
+# Release Process
+
+## Release changes to Staging
+
+_"As a contributor whose pull request has been been approved, I want to deploy my changes to Staging."_
+
+Simple – just merge your pull request!
+
+Any pull request merged to the `main` branch will automatically activate the deployment pipeline that targets the Staging environment.
+You can check the status of a Staging deployment by viewing the ["Deploy to Staging" workflow history](https://github.com/usdigitalresponse/usdr-gost/actions/workflows/deploy-staging.yml)
+
+## Release changes to Production
+
+_"As a team member with sufficient access to manage GitHub releases, I want to deploy a set of changes to Production."_
+
+### Scenario 1: All changes deployed to Staging have been successfully QA'd
+
+> [!TIP]
+> This is the simplest scenario, and our **preferred way** to deploy changes to Production.
+
+1. Navigate to the repository [Releases page](https://github.com/usdigitalresponse/usdr-gost/releases).
+2. Locate the current draft release. This will displayed at the top, along with a "Draft" label.
+3. Click the pencil icon for the draft release to edit it.
+4. In the "Write" tab for the release notes:
+    - Edit the placeholder text under the **Summary** heading to provide a brief description of the release as a benefit to stakeholders. Summaries are encouraged ("bug fixes and dependency updates" is fine), but if you don't want to provide one, be sure to delete the heading and its placeholder text.
+    - Optional: check for any uncategorized changes under the **Other changes** heading (this heading will only be present if there are uncategorized changes), and move/copy them to more appropriate category headings.
+5. Switch to the "Preview" tab and review the release notes to confirm that the release notes look suitable for publishing.
+6. Ensure that the "Set as pre-release" box is checked (it should be preselected), and then click "Publish Release".
+
+At this point, the deployment will start preparing to ship the changes associated with the published release.
+Once the changes are ready to ship, administrators will be notified to review the deployment plan created by Terraform and give final approval.
+For more information, refer to **What happens when a release is published?**
+
+### Scenario 2: Not all changes on Staging have been successfully QA'd, but we still want to deploy _some_ things to Production
+
+#### Scenario 2.1: Desired changes to deploy are contained in sequential commits directly following the latest release
+
+> [!TIP]
+> Use this workflow when there are consecutive commits that should be deployed to Production, up to a certain point.
+> That is, if the latest Production deployment/release tag point to commit A, and commits B, C, and D have since been added to `main`,
+> this workflow can be used to deploy commits B and C only.
+>
+> If non-sequential commits to `main` need to be deployed, refer to Scenario 2.2 below.
+
+Example scenario (all commits on `main`):
+```
+commit-A  <- Deployed to Production, tagged as the latest release
+commit-B  <- Successfully QA'd, ready for Production
+commit-C  <- Successfully QA'd, ready for Production
+commit-D  <- NOT successfully QA'd
+```
+
+1. Follow Steps 1-4 in **Scenario 1** to prepare the release notes.
+2. While editing the next draft release, select the "Target" dropdown menu, switch to the "Recent commits" tab, and select the final/latest commit in the series that you want to deploy.
+3. Edit the release notes to remove documented changes that come after the selected target commit (i.e. remove changes that will not be deployed in this release).
+4. Follow the remaining steps in **Scenario 1** to deploy the release.
+
+#### Scenario 2.2: Desired changes to deploy are contained in nonsequential commits
+
+> [!TIP]
+> Use this workflow when there are **nonconsecutive** commits that should be deployed to Production.
+> That is, if the latest Production deployment/release tag point to commit A, and commits B, C, D, and E have since been added to `main`,
+> this workflow can be used to deploy commits B and D only.
+>
+> If non-sequential commits to `main` need to be deployed, refer to Scenario 2.2 below.
+
+Example scenario (all commits on `main`):
+```
+commit-A  <- Deployed to Production, tagged as the latest release
+commit-B  <- Successfully QA'd, ready for Production
+commit-C  <- NOT successfully QA'd
+commit-D  <- Successfully QA'd, ready for Production
+commit-E  <- NOT successfully QA'd
+```
+
+> [!WARNING]
+> Check with a repository admin first to ensure that database migrations will not be affected and are compatible with the desired changes.
+
+> [!NOTE]
+> This use-case requires working knowledge of `git cherry-pick`.
+
+> [!IMPORTANT]
+> - Only commits that exist on `main` may cherry-picked for a release.
+> The deployment workflow checks that the contents of the specified release tag satisfy this requirement;
+> if the release tag contains any commit that is not also on `main` _or_ was not cherry-picked from a commit on `main`, the workflow execution will fail.
+> - Always be sure to provide the `-x` flag when running `git cherry-pick` so that the resulting commit message [includes a reference to the source commit](https://git-scm.com/docs/git-cherry-pick#Documentation/git-cherry-pick.txt--x).
+
+1. Check out a new branch based on the revision currently deployed to Production (i.e. the latest release tag).
+2. Cherry-pick the commit(s) onto the new branch from `main` that you want to include in the release.
+3. Push your branch that now contains the cherry-picked commits that you want to release.
+4. Follow Steps 1-4 in **Scenario 1** to prepare the release notes.
+5. While editing the next draft release, select the "Target" dropdown menu and use the "Branches" tab to select the branch that contains the cherry-picked commits that you want to release.
+6. Edit the release notes to remove documented changes were not cherry-picked (i.e. remove changes that will not be deployed in this release).
+7. Follow the remaining steps in **Scenario 1** to deploy the release.
+8. Optional: Delete the release branch (the release commit is now tagged; the branch is no longer needed)
+9. Optional: Generate the next draft release.
+    - Using the GitHub web UI:
+      1. Navigate to the ["Release Drafter" workflow](https://github.com/usdigitalresponse/usdr-gost/actions/workflows/release-drafter.yml)
+      2. Click "Run workflow"
+      3. Select the "Branch" dropdown menu and choose the `main` branch
+      4. Click the "Run workflow" button located beneath the selected branch.
+    - Using the GitHub CLI:
+      ```cli
+      gh workflow run "Release Drafter" --ref main
+      ```
+
+> [!TIP]
+> You can skip the final step if you want to wait for a new draft release to be created automatically the next time `main` is updated.
+
+### Scenario 3: Retry a failed deployment without making code changes.
+
+1. Use the ["Deploy to Production" workflow history](https://github.com/usdigitalresponse/usdr-gost/actions/workflows/deploy-production.yml) to locate and navigate to the failed workflow run.
+2. Click the "Re-run jobs" button. If prompted, select "Re-run all jobs".
+3. Wait for the new workflow run to generate a deployment plan and prompt administrators for review and approval.
+
+### Scenario 4: Revert the Production environment to a previous deployment.
+
+> [!WARNING]
+> Check with a repository admin first to ensure that database migrations will not be affected!
+
+- Using the GitHub web UI, using a recent deployment workflow:
+  1. Use the ["Deploy to Production" workflow history](https://github.com/usdigitalresponse/usdr-gost/actions/workflows/deploy-production.yml) to locate and navigate to the workflow run that you want to re-execute.
+  2. Click "Re-run all jobs".
+  3. Wait for the new workflow to generate a deployment plan and prompt administrators for review and approval.
+- Using the GitHub web UI, as a new workflow run:
+  1. Navigate to the ["Deploy to Production" workflow](https://github.com/usdigitalresponse/usdr-gost/actions/workflows/deploy-production.yml).
+  2. Click "Run workflow"
+  3. Select the "Branch" dropdown menu, switch to the "Tags" tab, and select the release tag that you want to deploy.
+  4. Wait for the new workflow to generate a deployment plan and prompt administrators for review and approval.
+- Using the GitHub CLI:
+  ```cli
+  gh workflow run "Deploy to Production" --ref release/1979.33
+  ```
+
+## What happens when a release is published?
+
+When a release is published, its configured tag is pushed based on the configured "Target" (usually the `main` branch).
+A push to any tag prefixed with `release/` will trigger the "Deploy to Production" workflow to execute for that tag, which performs the following steps:
+
+1. Validates the contents of the release tag to ensure that it only contains commits (and/or cherry-picked commits) from `main`.
+2. Builds and publishes deployment artifacts for the release.
+3. Generates a deployment plan for the changes associated with the release.
+4. Once a deployment plan has been generated and is ready to ship, repository administrators will be notified with a request to review and approve the deployment plan.
+5. Once approved, the pipeline execution will proceed with deploying the changes to Production.
+6. Following successful deployment, the deployment pipeline will update the release to:
+    - Remove its "Pre-release" label
+    - Add the "Latest" label
+    - Append the date and time of deployment under the "Release History" heading of the release notes.
+    - Upload build artifacts as release assets.
+
+## Useful Information
+
+### What is a tag, and how do we use them for releases?
+
+A tag is an alias that (for the purposes of this document) provides an alias that points to a specific commit. There are many different tagging conventions, but for the purposes of our release process, we are specifically talking about tags formatted as `release/<version-number>`, where `<version-number>` is comprised of two delimited elements: the year of the release, and a number that increments for each subsequent release for that year (i.e. `yyyy.N`). For example, `2023.5` would represent the fifth release published in 2023; `2024.16` would represent the 16th release published in 2024, etc.
+
+#### Why not semantic versioning?
+
+Many software projects (especially libraries) follow versioning schemes like [semantic versioning](https://semver.org/) because it standardizes an explicit way of communicating compatibility changes from one version to the next. You probably recognize semantic versions, like `v1.2.3`. However, because the usdsr-gost repository provides multiple services and offers no single, concrete contract (i.e. an API) about which downstream consumers contend with compatibility decisions, a semantic versioning scheme is less relevant and would likely create ambiguilties rather than clarifying them.
+
+### What is a release?
+
+[GitHub releases](https://docs.github.com/en/repositories/releasing-projects-on-github/managing-releases-in-a-repository) are a repository-level feature in GitHub that add documentation ("release notes") and static file assets (a repo snapshot, and optionally platform-specific build outputs) for a specific tag, which generally serves as a version identifier for the release.
+
+GitHub releases can be in either a **draft** or **published** state. When a release is a **draft**, it is still being assembled and not generally visible to the public. Furthermore, drafts do not have to be associated with a tag that exists in the repository. As mentioned elsewhere, we will use automation to do most of the work around creating release drafts and keeping their contents up-to-date, although humans are responsible for applying final edits to release notes and saving the final outcome as a **published** release. The most-recently published release to successfully deploy to Production is automatically marked as "latest" in GitHub.
+
+Ideally, the repository will always have exactly 1 draft release at any moment (provided there are pull requests that have been merged since the last published release), which can be thought of as the "next release". While no release tag will exist for a draft, we can determine what that tag will be at the time the draft is created by looking at the current year and the tag associated with the latest published release. For example, if the latest published release associated with a tag of `release/2023.4` and the current year is still 2023, we know that the tag associated with the next release will be associated with a tag of `release/2023.5`; if the year is 2024, the next release tag will be `release/2024.1`.
+
+#### Release Terminology
+
+- **Draft release:** A release which has been created in GitHub but is not yet available for public viewing. Ideally, exactly one release draft exists as long as there are changes on `main` that have not yet been deployed to Production.
+- **Published release:** Any release that is not a draft, i.e. is publicly viewable, and is considered to be a finalized representation of at least one change to Production.
+- **Latest release:** A label indicating the last (published) release that has successfully deployed to Production.
+- **Pre-release:** A label indicating that a published release has not yet fully and/or successfully deployed to Production.
diff --git a/docs/setup-windows.md b/docs/setup-windows.md
index 635cf90e2..4378c1c02 100644
--- a/docs/setup-windows.md
+++ b/docs/setup-windows.md
@@ -1,34 +1,78 @@
 # Setup - Windows
 
-See below for how to set up your development environment in Windows.
+See below for how to set up your development environment in Windows. You'll be installing Windows Subsystem for Linux (WSL 2), Docker, and the WSL extension for Visual Studio Code. This allows you to run a Linux environment directly on Windows and enables full use of Docker for running the app.
 
-* Requires: *Some Linux command line knowledge*  
+* Requires: *Some Linux command line familiarity*  
 * Takes: *A few hours depending on your machine and network connection (more if you hit errors). Requires multiple reboots.*
 
-## Prerequisites
+These steps are for an install on a Windows machine. Mac instructions are [here](./setup-mac.md).
 
-1. [Install Windows Subsystem for Linux](https://github.com/usdigitalresponse/usdr-gost/wiki/How-to-create-an-Ubuntu-instance-in-Windows-Subsystem-for-Linux)  
+## Install
 
-1. Install Docker Desktop for Windows
-   * See instructions [here](https://docs.docker.com/desktop/install/windows-install/)
-     * *Might want to read the system requirements*
-   * Take defaults
-   * Run Docker Desktop and accept license.
-   * Let it start.
-   * Verify in (restarted) Ubuntu terminal:  
+1. Follow these instructions to [install Windows Subsystem for Linux](https://github.com/usdigitalresponse/usdr-gost/wiki/How-to-create-an-Ubuntu-instance-in-Windows-Subsystem-for-Linux).
 
-     ```sh
-     $ docker --version
-     Docker version 20.10.17, build 100c701
-     ```
+2. [Install Docker Desktop for Windows](https://docs.docker.com/desktop/install/windows-install/) - note system requirements
+  * Take defaults.
+  * Run Docker Desktop and accept license.
+  * Let it start. You can continue without signing in.
+  * Restart Ubuntu terminal and verify the Docker installation:
 
-1. Install (and run) Visual Studio Code
-   * Instructions [here](https://code.visualstudio.com/docs/remote/wsl)
+    ```sh
+    $ docker --version
+    ```
 
-1. Run `git clone` as described in [platform-independent steps](https://github.com/usdigitalresponse/usdr-gost/wiki/Platform-independent-install-instructions).
+    You should see a version and build as the output.
+
+3. Install [Visual Studio Code](https://code.visualstudio.com/) if needed.
+
+## Set up WSL with VS Code and Docker
+### VS Code
+1. In VS Code, install the [WSL extension](https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-wsl) from Marketplace. This allows you to run VS Code in the WSL environment just as you would in Windows.
+
+2. Start typing into the search bar/command palette: `> WSL: Connect to WSL`. Select the command that comes up:
+
+![WSL: Connect to WSL option highlighted in VS Code](./img/setup-windows-wsl-connect.png)
+
+3. After that runs, VS Code will reopen in Ubuntu, as indicated by the status bar:
+
+![VS Code status bar showing that it's running in Ubuntu](./img/setup-windows-wsl-running.png)
+
+VS Code will remember this setting. If you want to exit WSL, go to the search bar and type `Close Remote Connection`.
+
+### Docker
+To enable WSL integration with Docker:
+- Go to Settings (in the header) > Resources > WSL Integration
+- Check off "Enable integration with my default WSL distro" and toggle on "Ubuntu" (it should be there if you have it installed - try the Refresh button if it isn't)
+- Apply & restart
+ ![Resources - WSL integration settings](./img/setup-windows-docker-integration.png)
+
+## Clone the repository
+1. Now you'll create a folder in the Linux (Ubuntu) file system to clone the `usdr-gost` repo in. You should see the Ubuntu file system represented in your file explorer.
+
+- Navigate to `\\wsl.localhost\Ubuntu\home\<Ubuntu-username>`.
+
+Example:
+
+![Linux folders expanded in Windows file explorer](./img/setup-windows-linux-files.png)
+
+- Within this folder, create a folder called `sources`. This is where you'll clone the repo.
+
+> Note: If you've already cloned the repo in Windows, you can just move it to this `sources` folder.
+
+2. Open the sources folder in VS Code and open up a Terminal. You should now be in `<Ubuntu-username>@<PC-name>:~/sources`
+
+Example:
+
+![Directory is the newly created 'sources' folder](./img/setup-windows-linux-path.png)
+
+3. Clone the repo to `sources`:
+- `git clone https://github.com/usdigitalresponse/usdr-gost.git`
+
+4. Get your Docker containers set up with the [Docker instructions](../docker/README.md). You can also run the rest of the [platform-independent steps](https://github.com/usdigitalresponse/usdr-gost/wiki/Platform-independent-install-instructions), which refer to the Docker instructions.
 
-1. Run the rest of the steps in [platform-independent steps](https://github.com/usdigitalresponse/usdr-gost/wiki/Platform-independent-install-instructions).
 
 ## Notes
 
 * After rebooting, you might have to run the Docker Desktop to start the Docker daemon (or add it to your startup as described [here](https://support.microsoft.com/en-us/windows/add-an-app-to-run-automatically-at-startup-in-windows-10-150da165-dcd9-7230-517b-cf3c295d89dd)).
+
+* For further reference: [VS Code docs on developing in WSL](https://code.visualstudio.com/docs/remote/wsl)
\ No newline at end of file
diff --git a/docs/styling.md b/docs/styling.md
index 975ba45ec..ad6ac74e1 100644
--- a/docs/styling.md
+++ b/docs/styling.md
@@ -68,8 +68,15 @@ If you are required to use a base token for which there is no corresponding sema
 
 ### Fonts
 
-The fonts used in the USDR design system are:
-- [Lora](https://fonts.google.com/specimen/Lora): heading font
-- [Inter](https://fonts.google.com/specimen/Inter): body font
+The font used in the USDR design system is:
+- [Inter](https://fonts.google.com/specimen/Inter): heading & body font
 
 These font styles are implemented in [fonts.scss](../packages/client/scss/fonts.scss).
+
+#### Accessibility note: Don't use heading elements for styling 💡
+Heading elements (`<h1>` through `<h6>`) represent page structure and should be logical: i.e., someone reading the headings or using a screen reader should be able to understand the general hierarchy of a page so they can quickly find the content they need. Headings should not be used for styling. If you need to use a text style that differs from the appropriate heading level within the page, use a class instead.
+
+Example:
+``` html
+<h2 class="h4">This text will render as an <h2> in the HTML but will look like an h4!</h2>
+```
\ No newline at end of file
diff --git a/packages/client/scss/colors-base-tokens.scss b/packages/client/scss/colors-base-tokens.scss
index 39f035548..8c9b09fdd 100644
--- a/packages/client/scss/colors-base-tokens.scss
+++ b/packages/client/scss/colors-base-tokens.scss
@@ -8,7 +8,7 @@
  */
 
 // USDR BRAND
-$usdr-brand-primary: #0066FF;
+$usdr-brand-primary: #305CE0;
 $usdr-brand-secondary: #071A51;
 
 // BLUE
diff --git a/packages/client/scss/colors-semantic-tokens.scss b/packages/client/scss/colors-semantic-tokens.scss
index abd6d880e..31f268aab 100644
--- a/packages/client/scss/colors-semantic-tokens.scss
+++ b/packages/client/scss/colors-semantic-tokens.scss
@@ -11,7 +11,6 @@
 
 // USDR BRAND
 $brand-primary: $usdr-brand-primary;
-$brand-default: $raw-blue-600;
 $brand-hover: $raw-blue-700;
 $brand-active: $raw-blue-800;
 $brand-content: $raw-white;
diff --git a/packages/client/scss/custom.scss b/packages/client/scss/custom.scss
index 3fe298ac1..d1d5a96ca 100644
--- a/packages/client/scss/custom.scss
+++ b/packages/client/scss/custom.scss
@@ -51,4 +51,36 @@ $theme-colors: map-merge(
 @import 'vue-select/src/scss/vue-select.scss';
 
 // SET USDR FONTS
-@import './fonts.scss';
\ No newline at end of file
+@import './fonts.scss';
+
+/* Dropshadow for the header */
+.header-dropshadow {
+  box-shadow: 0 1px 8px rgba(0,0,0,0.2);
+}
+
+/* Card with dropshadow - used on login screen */
+.dropshadow-card {
+  box-shadow: 0px 10px 15px -3px rgba(0,0,0,0.1),
+0px 4px 6px -2px rgba(0,0,0,0.05);
+  border-bottom: 1px solid #DFE1E6, 1px solid white;
+  border-radius: 16px;
+}
+
+hr {
+  border-color: $border;
+}
+
+/* Dashboard colors */
+.color-gray{
+  color: $text-placeholder;
+}
+.color-yellow{
+  color: $warning-default;
+}
+.color-red{
+  color: $negative-default;
+}
+
+.color-green {
+  color: $positive-default;
+}
\ No newline at end of file
diff --git a/packages/client/scss/fonts.scss b/packages/client/scss/fonts.scss
index 705e452f0..4b2664462 100644
--- a/packages/client/scss/fonts.scss
+++ b/packages/client/scss/fonts.scss
@@ -5,46 +5,57 @@
  */
 
 // IMPORT FONTS FROM GOOGLE FONTS:
-// LORA BOLD 700 (HEADING FONT)
 // INTER MEDIUM 500 (BODY FONT)
-@import url('https://fonts.googleapis.com/css2?family=Inter:wght@500&family=Lora:wght@700&display=swap');
+@import url('https://fonts.googleapis.com/css2?family=Inter:wght@500;700&display=swap');
 
-// SET HEADING FONTS TO LORA
-h1, h2, h3, h4, h5, h6 {
-  font-family: Lora, Helvetica, Arial, sans-serif;
+// SET BODY FONTS TO INTER
+body {
+  font-family: Inter, Helvetica, Arial, sans-serif;
+  font-size: 16px;
+  line-height: 150%;
+  font-weight: 500;
+  color: $text-primary;
+}
+
+// Setting the same styles for heading elements and heading classes so there's flexibility in separating semantic headings from visual heading style
+h1, .h1, h2, .h2, h3, .h3, h4, .h4, h5, .h5, h6, .h6 {
   font-weight: 700;
   line-height: 120%;
 }
 
-h1 {
-  font-size: 38px;
+h1, .h1 { // called 'headingXL' in USDR Design System
+  font-size: 2.375rem; // 38px
 }
 
-h2 {
-  font-size: 30px;
+h2, .h2 { // 'headingLarge'
+  font-size: 1.875rem; // 30px
 }
 
-h3 {
-  font-size: 20px;
+h3, .h3 { // 'headingMedium'
+  font-size: 1.25rem;
 }
 
-h4 {
-  font-size: 16px;
+h4, .h4 { // 'headingSmall'
+  font-size: 1rem;
+}
+
+h5, .h5, p { // 'headingXS' and 'body'
+  font-size: 0.875rem; // 14px
 }
 
-h5 {
-  font-size: 14px;
+h6, .h6, .caption { // 'caption'
+  font-size: 0.8125rem; // 13px
 }
 
 // SET BODY FONTS TO INTER
 body {
   font-family: Inter, Helvetica, Arial, sans-serif;
-  font-size: 14px;
+  font-size: 16px;
   line-height: 150%;
   font-weight: 500;
 }
 
-#app {
-  -webkit-font-smoothing: antialiased;
-  -moz-osx-font-smoothing: grayscale;
-}
+/* Bold text of active tabs and grant detail labels */
+.nav-tabs .nav-link.active, .data-label {
+  font-weight: 700;
+}
\ No newline at end of file
diff --git a/packages/client/src/App.vue b/packages/client/src/App.vue
index 76f9bada2..33936d937 100644
--- a/packages/client/src/App.vue
+++ b/packages/client/src/App.vue
@@ -19,7 +19,6 @@ export default {
 #app {
   -webkit-font-smoothing: antialiased;
   -moz-osx-font-smoothing: grayscale;
-  color: #2c3e50;
 }
 
 body {
diff --git a/packages/client/src/components/GrantsTableNext.vue b/packages/client/src/components/GrantsTableNext.vue
index bb24c2531..4ef439527 100644
--- a/packages/client/src/components/GrantsTableNext.vue
+++ b/packages/client/src/components/GrantsTableNext.vue
@@ -4,7 +4,7 @@
       <div class="ml-3">
         <SavedSearchPanel :isDisabled="loading" />
       </div>
-      <div class="ml-2">
+      <div class="ml-1">
         <SearchPanel :isDisabled="loading" ref="searchPanel" :search-id="Number(editingSearchId)" @filters-applied="paginateGrants" />
       </div>
     </b-row>
@@ -13,15 +13,16 @@
         <SearchFilter :isDisabled="loading" :filterKeys="searchFilters" @filter-removed="clearSearch" />
       </b-col>
       <b-col align-self="end" v-if="!showSearchControls">
-        <h4 class="mb-0">{{ searchTitle }}</h4>
+        <h2 class="mb-0">{{ searchTitle }}</h2>
       </b-col>
-      <b-col align-self="end">
-        <p class="mb-0 text-right text-nowrap"><a href="#" @click="exportCSV" :disabled="loading" variant="outline-primary border-0">Export CSV</a></p>
+      <b-col class="d-flex justify-content-end">
+        <b-button @click="exportCSV" :disabled="loading" variant="outline-primary" size="sm">
+          <b-icon icon="download" class="mr-2" aria-hidden="true" />Export to CSV</b-button>
       </b-col>
     </b-row>
     <b-row align-v="center">
       <b-col cols="12">
-        <b-table id="grants-table" sticky-header="70vh" hover :items="formattedGrants"
+        <b-table id="grants-table" hover responsive stacked="sm" :items="formattedGrants"
           :fields="fields.filter(field => !field.hideGrantItem)" selectable striped :sort-by.sync="orderBy"
           :sort-desc.sync="orderDesc" :no-local-sorting="true" :bordered="true" select-mode="single" :busy="loading"
           @row-selected="onRowSelected" show-empty emptyText="No matches found">
@@ -302,7 +303,7 @@ export default {
       }
     },
     notifyError() {
-      this.$bvToast.toast('We encountered an error while retriving grants data. For the most accurate results please refresh the page and try again.', {
+      this.$bvToast.toast('We encountered an error while retrieving grants data. For the most accurate results please refresh the page and try again.', {
         title: 'Something went wrong',
         variant: 'danger',
         solid: true,
diff --git a/packages/client/src/components/Layout.vue b/packages/client/src/components/Layout.vue
index f0ebbed24..4ae29e5ba 100755
--- a/packages/client/src/components/Layout.vue
+++ b/packages/client/src/components/Layout.vue
@@ -1,16 +1,16 @@
 <template>
   <div>
-    <b-navbar :type="navBarType" :variant="navBarVariant">
+    <b-navbar :type="navBarType" :variant="navBarVariant" class="header-dropshadow py-3">
       <b-navbar-brand href="/#/grants" class="d-flex align-items-center">
-      <b-img v-if="myProfileEnabled" :src="require('../assets/usdr_logo_standard_wide.svg')" style="height: 1.625rem;" class="" alt="United States Digital Response logo" />
-      <b-img v-else :src="require('../assets/usdr_logo_white_wide.svg')" style="height: 1.625rem;" class="" alt="United States Digital Response logo in white" />
-      <h3 class="ml-3 mb-0">Grants Identification Tool</h3>
+      <b-img v-if="myProfileEnabled" :src="require('../assets/usdr_logo_standard_wide.svg')" style="height: 2.5rem;" class="" alt="United States Digital Response - Home" />
+      <b-img v-else :src="require('../assets/usdr_logo_white_wide.svg')" style="height: 2.5rem;" class="" alt="United States Digital Response - Home" />
+      <h1 class="ml-3 mb-0 h4">Federal Grant Finder</h1>
     </b-navbar-brand>
       <b-collapse id="nav-collapse" is-nav>
 
         <!-- Right aligned nav items -->
         <b-navbar-nav class="ml-auto">
-          <b-nav-item-dropdown right v-if="loggedInUser && myProfileEnabled" no-caret>
+          <b-nav-item-dropdown right v-if="loggedInUser && myProfileEnabled" no-caret menu-class="w-100">
             <!-- Using 'button-content' slot -->
             <template v-if="myProfileEnabled" #button-content>
               <div class="d-inline-flex justify-content-start align-items-center" style="width: 242px">
@@ -25,10 +25,22 @@
             <template v-else #button-content>
               <em>{{loggedInUser.email}}</em>
             </template>
-            <b-dropdown-item-button href="#" @click="settingsClicked">Settings</b-dropdown-item-button>
-            <b-dropdown-item-button href="#" @click="giveFeedback">Give Feedback</b-dropdown-item-button>
-            <b-dropdown-item-button href="#" @click="trainingGuide">Training Guide</b-dropdown-item-button>
-            <b-dropdown-item-button href="#" @click="logout">Sign Out</b-dropdown-item-button>
+            <b-dropdown-item href="#/my-profile">
+              <b-icon icon="person-circle" scale="1" class="dropdown-icon"></b-icon>
+              <p class="dropdown-item-text">My profile</p>
+            </b-dropdown-item>
+            <b-dropdown-item-button href="#" @click="giveFeedback">
+              <b-icon icon="chat-square-text" scale="1" class="dropdown-icon"></b-icon>
+              <p class="dropdown-item-text">Give feedback</p>
+            </b-dropdown-item-button>
+            <b-dropdown-item-button href="#" @click="trainingGuide">
+              <b-icon icon="book" scale="1" class="dropdown-icon"></b-icon>
+              <p class="dropdown-item-text">Training guide</p>
+            </b-dropdown-item-button>
+            <b-dropdown-item-button href="#" @click="logout">
+              <b-icon icon="box-arrow-right" scale="1" class="dropdown-icon"></b-icon>
+              <p class="dropdown-item-text">Sign out</p>
+            </b-dropdown-item-button>
           </b-nav-item-dropdown>
 
           <b-nav-text v-if="!myProfileEnabled">
@@ -145,6 +157,16 @@ export default {
 </script>
 
 <style scoped lang="scss">
+.dropdown-icon {
+  margin-right: 1rem;
+}
+
+.dropdown-item-text {
+  font-size: 14px;
+  display: inline;
+  text-align: left;
+  padding: 0;
+}
 .text-black {
   color: #000;
 }
diff --git a/packages/client/src/components/Modals/EditTeam.vue b/packages/client/src/components/Modals/EditTeam.vue
index 2fdfc2a93..7d3ddeaea 100644
--- a/packages/client/src/components/Modals/EditTeam.vue
+++ b/packages/client/src/components/Modals/EditTeam.vue
@@ -100,8 +100,7 @@
         </b-form-group>
         <form ref="form" @click="handleDelete">
           <span id="disabled-wrapper" class="d-inline-block" tabindex="0">
-            <b-button v-bind:disabled="userRole !== 'admin'" style="pointer-events: none;" variant="danger">
-              Admin Delete {{newTerminologyEnabled ? 'Team' : 'Agency'}}
+            <b-button v-bind:disabled="userRole !== 'admin'" variant="outline-danger"> Delete {{newTerminologyEnabled ? 'Team' : 'Agency'}}
             </b-button>
           </span>
           <b-tooltip v-if="userRole !== 'admin'" target="disabled-wrapper" triggers="hover">
diff --git a/packages/client/src/components/Modals/GrantDetails.vue b/packages/client/src/components/Modals/GrantDetails.vue
index d133c3b90..935cca2ba 100644
--- a/packages/client/src/components/Modals/GrantDetails.vue
+++ b/packages/client/src/components/Modals/GrantDetails.vue
@@ -1,35 +1,34 @@
 <!-- eslint-disable max-len -->
 <template>
-  <b-modal v-model="showDialog" ok-only :title="selectedGrant && selectedGrant.title" @hide="resetSelectedGrant"
-    scrollable size="lg" header-bg-variant="primary" header-text-variant="light" body-bg-variant="light"
-    body-text-variant="dark" footer-bg-variant="dark" footer-text-variant="light">
+  <b-modal v-model="showDialog" ok-only :title="selectedGrant && selectedGrant.grant_number" @hide="resetSelectedGrant"
+    scrollable size="xl">
     <div v-if="selectedGrant">
-      <b-row>
-        <b-col cols="9">
-          <h3>Grant Number: {{ selectedGrant.grant_number }}</h3>
+      <b-row class="mb-3 d-flex align-items-baseline">
+        <b-col cols="8">
+          <h1 class="mb-0 h2">{{ selectedGrant.title }}</h1>
         </b-col>
-        <b-col cols="3" class="text-right">
+        <b-col cols="4" class="text-right">
           <b-button :href="`https://www.grants.gov/web/grants/view-opportunity.html?oppId=${selectedGrant.grant_id}`"
             target="_blank" rel="noopener noreferrer" variant="primary">
-            Grants.Gov <b-icon icon="link" aria-hidden="true"></b-icon>
+            <b-icon icon="box-arrow-up-right" aria-hidden="true" class="mr-2"></b-icon>View on Grants.gov
           </b-button>
         </b-col>
       </b-row>
-      <p><span style="font-weight:bold">Valid from:</span> {{ new
+      <p><span class="data-label">Valid from:</span> {{ new
           Date(selectedGrant.open_date).toLocaleDateString('en-US', { timeZone: 'UTC' })
       }}-{{ new
     Date(selectedGrant.close_date).toLocaleDateString('en-US', { timeZone: 'UTC' })
 }}</p>
       <div v-for="field in dialogFields" :key="field">
-        <p><span style="font-weight:bold">{{ titleize(field) }}:</span> {{ selectedGrant[field] }}</p>
+        <p><span class="data-label">{{ titleize(field) }}:</span> {{ selectedGrant[field] }}</p>
       </div>
-      <h6>Description</h6>
+      <p class="data-label">Description:</p>
       <div style="max-height: 170px; overflow-y: scroll">
         <div style="white-space: pre-line" v-html="selectedGrant.description"></div>
       </div>
       <br />
-      <b-row style="padding: 16px;">
-        <h4>{{newTerminologyEnabled ? 'Team': 'Agency'}} Status</h4>
+      <b-row class="ml-2 mb-2 d-flex align-items-baseline">
+        <h2 class="h4">{{newTerminologyEnabled ? 'Team': 'Agency'}} Status</h2>
         <b-col class="text-right">
           <b-row v-if="!interested">
             <b-col cols="9">
@@ -48,7 +47,7 @@
                 </b-form-select-option-group>
               </b-form-select>
             </b-col>
-            <b-button variant="outline-success" @click="markGrantAsInterested">Submit</b-button>
+            <b-button variant="outline-primary" @click="markGrantAsInterested">Submit</b-button>
           </b-row>
           <b-row v-if="interested && interested.interested_status_code !== 'Rejection'&& shouldShowSpocButton">
             <b-col>
@@ -62,25 +61,25 @@
         <template #cell(actions)="row">
           <b-row
             v-if="(String(row.item.agency_id) === selectedAgencyId) || isAbleToUnmark(row.item.agency_id)">
-            <b-button variant="danger" class="mr-1" size="sm" @click="unmarkGrantAsInterested(row)">
+            <b-button variant="outline-danger" class="mr-1 border-0" size="sm" @click="unmarkGrantAsInterested(row)">
               <b-icon icon="trash-fill" aria-hidden="true"></b-icon>
             </b-button>
           </b-row>
         </template>
       </b-table>
       <br />
-      <b-row style="padding: 16px;">
-        <h4>Assigned {{newTerminologyEnabled ? 'Teams': 'Agencies'}}</h4>
+      <b-row class="ml-2 mb-2 d-flex align-items-baseline">
+        <h2 class="h4">Assigned {{newTerminologyEnabled ? 'Teams': 'Agencies'}}</h2>
           <multiselect v-model="selectedAgencies" :options="agencies" :multiple="true" :close-on-select="false"
             :clear-on-select="false" :placeholder="`Select ${newTerminologyEnabled ? 'teams': 'agencies'}`" label="name" track-by="id"
             style="width: 300px; margin: 0 16px;" :show-labels="false"
           >
           </multiselect>
-          <b-button variant="outline-success" @click="assignAgenciesToGrant">Assign</b-button>
+          <b-button variant="outline-primary" @click="assignAgenciesToGrant">Assign</b-button>
       </b-row>
       <b-table :items="assignedAgencies" :fields="assignedAgenciesFields">
         <template #cell(actions)="row">
-          <b-button variant="danger" class="mr-1" size="sm" @click="unassignAgenciesToGrant(row)">
+          <b-button variant="outline-danger" class="mr-1 border-0" size="sm" @click="unassignAgenciesToGrant(row)">
             <b-icon icon="trash-fill" aria-hidden="true"></b-icon>
           </b-button>
         </template>
diff --git a/packages/client/src/components/SearchFilter.vue b/packages/client/src/components/SearchFilter.vue
index 71c2b005e..291c1ab9e 100644
--- a/packages/client/src/components/SearchFilter.vue
+++ b/packages/client/src/components/SearchFilter.vue
@@ -2,7 +2,7 @@
   <div class="filter-container d-flex">
     <div class="align-self-end">
       <div class="align-self-end">
-        <h4 class="mb-0">{{ selectedSearch === null ? "All Grants" : searchName }} </h4>
+        <h2 class="mb-0 h4">{{ selectedSearch === null ? "All Grants" : searchName }} </h2>
         <span v-if="selectedSearch !== null">
           <a href="#" :class="{ inactiveLink: isDisabled }" v-on:click.prevent="editFilter">Edit</a> |
           <a href="#" :class="{ inactiveLink: isDisabled }" v-on:click.prevent="clearAll" >Clear</a>
@@ -71,9 +71,11 @@ export default {
 };
 
 </script>
-<style>
+<style lang="scss">
+@import '../../scss/colors-semantic-tokens.scss';
+
 .inactiveLink {
   pointer-events: none;
-  color: grey;
+  color: $text-placeholder;
 }
 </style>
diff --git a/packages/client/src/views/Dashboard.vue b/packages/client/src/views/Dashboard.vue
index 856a93437..5e97ee84a 100644
--- a/packages/client/src/views/Dashboard.vue
+++ b/packages/client/src/views/Dashboard.vue
@@ -49,7 +49,7 @@
           <b-col>
             <b-card>
               <div class="card-block text-left">
-                <h4 class="card-title gutter-title2 row">Upcoming Closing Dates</h4>
+                <h2 class="card-title gutter-title2 row h4">Upcoming Closing Dates</h2>
                 <span id="noUpcomingCloseDates" class="gutter-title2 row" v-if="!grantsAndIntAgens?.length">Your {{newTerminologyEnabled ? 'team' : 'agency'}} has no upcoming close dates.</span>
               </div>
               <b-table sticky-header='350px' hover :items='grantsAndIntAgens' :fields='upcomingFields'
@@ -62,7 +62,7 @@
                   <div v-if="field.key === 'close_date' && yellowDate === true" :style="field.trStyle" v-text="value"></div>
                   <div v-if="field.key === 'close_date' && redDate === true" :style="field.tdStyle" v-text="value"></div>
                   <div v-if="field.key === 'close_date' && blackDate === true" :style="field.tlStyle" v-text="value"></div>
-                  <div v-if="(grantsAndIntAgens[index]) && (field.key === 'title') && (value === grantsAndIntAgens[index].title)" :style="{color:'#757575'}">{{grantsAndIntAgens[index].interested_agencies}}</div>
+                  <div v-if="(grantsAndIntAgens[index]) && (field.key === 'title') && (value === grantsAndIntAgens[index].title)" class="color-gray">{{grantsAndIntAgens[index].interested_agencies}}</div>
                 </template>
               </b-table>
               <div v-if="totalUpcomingGrants > 3">
@@ -117,19 +117,6 @@
 </template>
 
 <style scoped>
-.color-gray{
-  color: #757575;
-}
-.color-yellow{
-  color: #aa8866;
-}
-.color-red{
-  color: #ae1818;
-}
-
-.color-green {
-  color: green;
-}
 .gutter-icon.row {
     margin-right: -8px;
     margin-left: -8px;
@@ -203,14 +190,14 @@ export default {
           formatter: 'formatDate',
           thStyle: { width: '20%' },
           tdStyle: {
-            color: '#ae1818',
+            color: '#C22E31',
             fontWeight: 'bold',
           },
           tlStyle: {
             color: 'black',
           },
           trStyle: {
-            color: '#aa8866',
+            color: '#956F0D',
             fontWeight: 'bold',
           },
           fontWeight: 'bold',
@@ -247,7 +234,7 @@ export default {
           sortByFormatted: false,
           formatter: 'formatMoney',
           style: {
-            color: '#757575',
+            color: '#6D7278',
           },
           class: 'text-right',
         },
diff --git a/packages/client/src/views/Login.vue b/packages/client/src/views/Login.vue
index 1ca06e036..ee54eb45e 100755
--- a/packages/client/src/views/Login.vue
+++ b/packages/client/src/views/Login.vue
@@ -2,22 +2,24 @@
   <b-card
     no-body
     tag="div"
-    style="max-width: 32rem; border: none; margin-top: 12rem"
-    class="mx-auto"
+    style="max-width: 26rem; margin-top: 11rem"
+    class="mx-auto border-0"
   >
     <b-card-img
-      :src="require('../assets/usdr_logo_standard_wide.svg')"
-      style="max-width: 20rem;"
-      alt="United States Digital Response logo in standard colors"
-      top
-    ></b-card-img>
-
-    <b-card-text class="pt-5">
-      <h1>Grants Identification Tool</h1>
-      <form @submit="login" class="mt-3">
-        <div class="form-group">
+        :src="require('../assets/usdr_logo_standard_wide.svg')"
+        style="max-width: 14rem"
+        alt="United States Digital Response logo"
+        class="mx-auto mb-3"
+        top
+      ></b-card-img>
+    <b-card-text class="mt-4 p-3 dropshadow-card">
+      <h1 class="h3 my-4">Log in to Federal Grant Finder</h1>
+      <p class="mb-4">Enter your email to receive a one-time login link.</p>
+      <form @submit="login">
+        <div>
+          <label for="email">Email</label>
           <input
-            class="form-control"
+            class="form-control mb-4"
             id="email"
             name="email"
             placeholder="Email address"
@@ -26,7 +28,7 @@
           />
         </div>
         <div
-          class="form-group d-flex justify-content-center"
+          class="d-flex justify-content-center"
         >
           <b-button
             variant="primary"
@@ -34,16 +36,18 @@
             type="Submit"
             @click="login"
           >
-            Login
+            Send me the link
           </b-button>
         </div>
       </form>
       <div :class="messageClass" class="mt-3" v-if="message">{{ message }}</div>
-      <div>
-        To create an account for your government, please fill out
-        <a href="https://www.usdigitalresponse.org/contact-us" target="_blank">USDR's request form</a>
-        and indicate that you'd like to create an account on our Hosted Grants Tool.
-      </div>
+      <hr class="my-4"/>
+      <p>
+        Don't have an account? Please fill out
+        <a href="https://form.jotform.com/201195733501145" target="_blank">USDR's request form</a>
+        and indicate you'd like to create one.
+      </p>
+      <p>Need help? <a href="mailto:grants-helpdesk@usdigitalresponse.org?subject=Federal Grant Finder Login Issue">Contact us</a> for support.</p>
     </b-card-text>
   </b-card>
 </template>
@@ -114,13 +118,3 @@ export default {
   },
 };
 </script>
-
-<style scoped>
-.login {
-  width: 90%;
-  margin: 44px auto;
-}
-h4 {
-  margin: 100px 0 20px 0;
-}
-</style>
diff --git a/packages/client/src/views/Organizations.vue b/packages/client/src/views/Organizations.vue
index fd6a666ef..c385d9b0c 100644
--- a/packages/client/src/views/Organizations.vue
+++ b/packages/client/src/views/Organizations.vue
@@ -1,11 +1,11 @@
 <template>
 <section class="container-fluid">
   <b-row>
-    <b-col><h2>{{newTerminologyEnabled ? 'Organizations' : 'Tenants'}}</h2></b-col>
+    <b-col class="m-2"><h2 class="h4">{{newTerminologyEnabled ? 'Organizations' : 'Tenants'}}</h2></b-col>
     <b-col></b-col>
     <b-col class="d-flex justify-content-end">
       <div>
-        <b-button variant="success" @click="openAddOrganizationModal">Add</b-button>
+        <b-button variant="primary" size="sm" @click="openAddOrganizationModal">Add</b-button>
       </div>
     </b-col>
   </b-row>
@@ -14,7 +14,7 @@
         {{row.item.display_name}}
       </template>
       <template #cell(actions)="row">
-      <b-button class="mr-1" size="sm" @click="openEditOrganizationModal(row.item)">
+      <b-button class="mr-1 border-0" size="sm" variant="outline-primary" @click="openEditOrganizationModal(row.item)">
         <b-icon icon="pencil-fill" aria-hidden="true"></b-icon>
       </b-button>
     </template>
diff --git a/packages/client/src/views/RecentActivity.vue b/packages/client/src/views/RecentActivity.vue
index c9dc2cbe2..2e5f3bea4 100644
--- a/packages/client/src/views/RecentActivity.vue
+++ b/packages/client/src/views/RecentActivity.vue
@@ -2,7 +2,7 @@
   <section class="container">
     <b-card class="border-0">
     <div class="d-flex">
-      <h4 class="card-title gutter-title1 row">Recent Activity</h4>
+      <h2 class="card-title gutter-title1 row h4">Recent Activity</h2>
       <div class="justify-content-end left-margin">
         <b-button @click="exportCSV" :disabled="loading" variant="outline-secondary">
         <b-icon icon="download" class="mr-1 mb-1" font-scale="0.9" aria-hidden="true" />
@@ -59,18 +59,6 @@
   </section>
 </template>
 <style scoped>
-.color-gray {
-  color: #757575
-}
-.color-red {
-  color: #ae1818;
-}
-.color-green {
-  color: green;
-}
-.color-yellow{
-  color: #aa8866;
-}
 .gutter-icon.row {
     margin-right: -8px;
     margin-left: -8px;
diff --git a/packages/client/src/views/Teams.vue b/packages/client/src/views/Teams.vue
index 929e9764c..9618206d1 100644
--- a/packages/client/src/views/Teams.vue
+++ b/packages/client/src/views/Teams.vue
@@ -1,14 +1,14 @@
 <template>
 <section class="container-fluid">
   <b-row>
-    <b-col><h2>{{newTerminologyEnabled ? 'Teams' : 'Agencies'}}</h2></b-col>
+    <b-col class="m-2"><h2 class="h4">{{newTerminologyEnabled ? 'Teams' : 'Agencies'}}</h2></b-col>
     <b-col></b-col>
     <b-col class="d-flex justify-content-end" v-if="userRole === 'admin'">
       <div>
-        <b-button id="bulkTeamImportButton" variant="success" @click="openUploadTeamsModal" class="mr-1">Bulk Import</b-button>
+        <b-button id="addTeamButton" class="mr-1" variant="primary" size="sm" @click="openAddTeamModal">Add</b-button>
       </div>
       <div>
-        <b-button id="addTeamButton" variant="success" @click="openAddTeamModal">Add</b-button>
+        <b-button id="bulkTeamImportButton" variant="outline-primary" @click="openUploadTeamsModal" size="sm">Bulk Import</b-button>
       </div>
     </b-col>
   </b-row>
@@ -23,7 +23,7 @@
       {{row.item.danger_threshold}} days
     </template>
     <template #cell(actions)="row">
-      <b-button v-if="userRole === 'admin'" class="mr-1" size="sm" @click="openEditTeamModal(row.item)">
+      <b-button v-if="userRole === 'admin'" class="mr-1 border-0" size="sm" variant="outline-primary" @click="openEditTeamModal(row.item)">
         <b-icon icon="pencil-fill" aria-hidden="true"></b-icon>
       </b-button>
     </template>
diff --git a/packages/client/src/views/UpcomingClosingDates.vue b/packages/client/src/views/UpcomingClosingDates.vue
index 7bbff9678..969530add 100644
--- a/packages/client/src/views/UpcomingClosingDates.vue
+++ b/packages/client/src/views/UpcomingClosingDates.vue
@@ -20,7 +20,7 @@
         <div v-if="field.key == 'close_date' && yellowDate == true" :style="field.trStyle" v-text="value"></div>
         <div v-if="field.key == 'close_date' && redDate == true" :style="field.tdStyle" v-text="value"></div>
         <div v-if="field.key == 'close_date' && blackDate == true" :style="field.tlStyle" v-text="value"></div>
-        <div v-if="(grantsAndIntAgens[index]) && (field.key == 'title') && (value == grantsAndIntAgens[index].title)" :style="{color:'#757575'}">{{grantsAndIntAgens[index].interested_agencies}}</div>
+        <div v-if="(grantsAndIntAgens[index]) && (field.key == 'title') && (value == grantsAndIntAgens[index].title)" class="color-gray">{{grantsAndIntAgens[index].interested_agencies}}</div>
       </template>
     </b-table>
     </b-card>
@@ -34,15 +34,6 @@
   </section>
 </template>
 <style scoped>
-.color-gray {
-  color: #757575
-}
-.color-red {
-  color: #ae1818;
-}
-.color-green {
-  color: green;
-}
 .gutter-icon.row {
     margin-right: -8px;
     margin-left: -8px;
@@ -85,11 +76,11 @@ export default {
           formatter: 'formatDate',
           thStyle: { width: '20%' },
           tdStyle: {
-            color: '#ae1818',
+            color: '#C22E31',
             fontWeight: 'bold',
           },
           trStyle: {
-            color: '#aa8866',
+            color: '#956F0D',
             fontWeight: 'bold',
           },
           tlStyle: {
diff --git a/packages/client/src/views/Users.vue b/packages/client/src/views/Users.vue
index 17448b9a4..f62c0c6d2 100644
--- a/packages/client/src/views/Users.vue
+++ b/packages/client/src/views/Users.vue
@@ -1,16 +1,11 @@
 <template>
   <section class="container-fluid">
     <b-row>
-      <b-col>
-        <h2>Users</h2>
-      </b-col>
-      <b-col></b-col>
+      <b-col class="m-2"><h2 class="h4">Users</h2></b-col>
       <b-col class="d-flex justify-content-end">
         <div>
-          <b-button variant="success" @click="openUploadUsersModal" class="mr-1">Bulk Import</b-button>
-        </div>
-        <div>
-          <b-button variant="success" @click="openAddUserModal" class="mr-1">Add</b-button>
+          <b-button variant="success" size="sm" class="mr-1" @click="openAddUserModal">Add</b-button>
+          <b-button variant="success" size="sm" @click="openUploadUsersModal">Bulk Import</b-button>
         </div>
       </b-col>
     </b-row>
diff --git a/packages/client/tests/unit/components/Layout.spec.js b/packages/client/tests/unit/components/Layout.spec.js
index 89088c9ac..856067e05 100644
--- a/packages/client/tests/unit/components/Layout.spec.js
+++ b/packages/client/tests/unit/components/Layout.spec.js
@@ -46,8 +46,8 @@ describe('Layout.vue', () => {
       });
     });
     it('should show the Grants heading', () => {
-      const layoutHeader = wrapper.get('h3');
-      expect(layoutHeader.text()).to.include('Grants Identification Tool');
+      const layoutHeader = wrapper.get('h1');
+      expect(layoutHeader.text()).to.include('Federal Grant Finder');
     });
     it('should show My Grants tab', () => {
       const navItem = wrapper.get('[to="/my-grants"]');
diff --git a/packages/e2e/cypress/e2e/spec.cy.js b/packages/e2e/cypress/e2e/spec.cy.js
index 26cd61250..55271b483 100644
--- a/packages/e2e/cypress/e2e/spec.cy.js
+++ b/packages/e2e/cypress/e2e/spec.cy.js
@@ -15,5 +15,5 @@ it('loads page', () => {
         return false;
     });
 
-    cy.contains('Grants Identification Tool');
+    cy.contains('Federal Grant Finder');
 });
diff --git a/packages/server/.nycrc b/packages/server/.nycrc
new file mode 100644
index 000000000..628a3e549
--- /dev/null
+++ b/packages/server/.nycrc
@@ -0,0 +1,3 @@
+{
+    "include": "src/**"
+}
diff --git a/packages/server/__tests__/api/grants.test.js b/packages/server/__tests__/api/grants.test.js
index 3470860a8..2e9ab3468 100644
--- a/packages/server/__tests__/api/grants.test.js
+++ b/packages/server/__tests__/api/grants.test.js
@@ -477,7 +477,7 @@ describe('`/api/grants` endpoint', () => {
                 'Opportunity Number',
                 'Title',
                 'Viewed By',
-                'Interested Teams',
+                process.env.ENABLE_NEW_TEAM_TERMINOLOGY === 'true' ? 'Interested Teams' : 'Interested Agencies',
                 'Opportunity Status',
                 'Opportunity Category',
                 'Cost Sharing',
@@ -603,7 +603,10 @@ describe('`/api/grants` endpoint', () => {
             const query = '?searchTerm=333816';
             const response = await fetchApi(`/grants/exportCSV${query}`, agencies.own, fetchOptions.staff);
 
-            const expectedCsv = `Opportunity Number,Title,Viewed By,Interested Teams,Status,Opportunity Category,Cost Sharing,Award Ceiling,Posted Date,Close Date,Agency Code,Grant Id,URL
+            const expectedCsv = process.env.ENABLE_NEW_TEAM_TERMINOLOGY === 'true'
+                ? `Opportunity Number,Title,Viewed By,Interested Teams,Status,Opportunity Category,Cost Sharing,Award Ceiling,Posted Date,Close Date,Agency Code,Grant Id,URL
+HHS-2021-IHS-TPI-0001,Community Health Aide Program:  Tribal Planning &`
+                : `Opportunity Number,Title,Viewed By,Interested Agencies,Status,Opportunity Category,Cost Sharing,Award Ceiling,Posted Date,Close Date,Agency Code,Grant Id,URL
 HHS-2021-IHS-TPI-0001,Community Health Aide Program:  Tribal Planning &`;
 
             expect(response.statusText).to.equal('OK');
diff --git a/packages/server/__tests__/arpa_reporter/server/services/validate-data/index.spec.js b/packages/server/__tests__/arpa_reporter/server/services/validate-data/index.spec.js
deleted file mode 100644
index 88d898b65..000000000
--- a/packages/server/__tests__/arpa_reporter/server/services/validate-data/index.spec.js
+++ /dev/null
@@ -1,76 +0,0 @@
-/* eslint no-unused-expressions: "off" */
-
-const { validateData } = requireSrc(__filename);
-const { expect } = require('chai');
-
-describe.skip('validateData', () => {
-    const records = [
-        {
-            type: 'cover',
-            content: {
-                'agency code': '1',
-                'project id': '100',
-            },
-        },
-        {
-            type: 'subrecipient',
-            content: {
-                'duns number': '1001',
-                'legal name': 'Acme',
-                'organization type': 'Other',
-            },
-        },
-        {
-            type: 'certification',
-            content: {
-                'agency financial reviewer name': 'John Doe',
-                date: 44175,
-            },
-        },
-        {
-            type: 'grants',
-            content: {
-                compliance: 'Yes',
-                'project id': '100',
-                'subrecipient id': '1001',
-                'award number': '1',
-                'award amount': 10, // v2 validation requires >= 50K
-                'current quarter obligation': 10,
-                'award payment method': 'Lump Sum Payment(s)',
-                'award date': 44044,
-                'period of performance start date': 44050,
-                'primary place of performance address line 1': '85 Pike St',
-                'primary place of performance city name': 'Seattle',
-                'primary place of performance country name': 'United States',
-                'primary place of performance state code': 'WA',
-            },
-        },
-    ];
-    it('ignores tagged validations by default', () => {
-        const reportingPeriod = {
-            start_date: new Date(2020, 3, 1),
-            end_date: new Date(2020, 9, 30),
-            period_of_performance_end_date: new Date(2020, 12, 30),
-            crf_end_date: new Date(2020, 12, 30),
-            validation_rule_tags: [],
-        };
-        const fileParts = { agencyCode: '1', projectId: '100' };
-        const result = validateData(records, fileParts, reportingPeriod, {}, new Date(2020, 3, 1));
-        expect(result, JSON.stringify(result)).to.be.empty;
-    });
-    it('includes tagged validations', () => {
-        const reportingPeriod = {
-            start_date: new Date(2020, 3, 1),
-            end_date: new Date(2020, 9, 30),
-            period_of_performance_end_date: new Date(2020, 12, 30),
-            crf_end_date: new Date(2020, 12, 30),
-            validation_rule_tags: ['v2'],
-        };
-        const fileParts = { agencyCode: '1', projectId: '100' };
-        const result = validateData(records, fileParts, reportingPeriod, {}, new Date(2020, 3, 1));
-        expect(result, JSON.stringify(result)).to.have.length(1);
-        expect(result[0].info.message).to.equal('Contract amount must be at least $50,000');
-    });
-});
-
-// NOTE: This file was copied from tests/server/services/validate-data/index.spec.js (git @ ada8bfdc98) in the arpa-reporter repo on 2022-09-23T20:05:47.735Z
diff --git a/packages/server/__tests__/arpa_reporter/server/services/validate-data/validate.spec.js b/packages/server/__tests__/arpa_reporter/server/services/validate-data/validate.spec.js
deleted file mode 100644
index 407f653bd..000000000
--- a/packages/server/__tests__/arpa_reporter/server/services/validate-data/validate.spec.js
+++ /dev/null
@@ -1,455 +0,0 @@
-const {
-    contractMatches,
-    cumulativeAmountIsEqual,
-    dateIsInPeriodOfPerformance,
-    dateIsInReportingPeriod,
-    isAtLeast50K,
-    isNotBlank,
-    isNumber,
-    isNumberOrBlank,
-    isPositiveNumber,
-    isPositiveNumberOrZero,
-    isSum,
-    isValidDate,
-    isValidState,
-    isValidSubrecipient,
-    isValidZip,
-    matchesFilePart,
-    messageValue,
-    numberIsLessThanOrEqual,
-    numberIsGreaterThanOrEqual,
-    validateFields,
-    validateRecords,
-    whenBlank,
-    whenGreaterThanZero,
-    whenUS,
-} = requireSrc(__filename);
-const { expect } = require('chai');
-
-describe('validation helpers', () => {
-    const validateContext = {
-        fileParts: {
-            projectId: 'DOH',
-        },
-        subrecipientsHash: {
-            1010: {
-                name: 'Payee',
-            },
-        },
-        reportingPeriod: {
-            startDate: '2020-03-01',
-            endDate: '2020-09-30',
-            periodOfPerformanceEndDate: '2020-12-30',
-            crfEndDate: '2020-12-30',
-        },
-        firstReportingPeriodStartDate: '2020-03-01',
-        periodSummaries: {
-            periodSummaries: [
-                {
-                    project_code: '1',
-                    award_number: '1001',
-                    award_type: 'contracts',
-                    current_obligation: 100.0,
-                    current_expenditure: 10.00,
-                },
-                {
-                    project_code: '1',
-                    award_number: '1001',
-                    award_type: 'contracts',
-                    current_obligation: 200.0,
-                    current_expenditure: 20.00,
-                },
-                {
-                    project_code: '2',
-                    award_number: '2002',
-                    award_type: 'contracts',
-                    current_obligation: 200.0,
-                    current_expenditure: 20.00,
-                },
-            ],
-        },
-    };
-    const testCases = [
-
-        ['blank string', isNotBlank(''), false],
-        ['non blank string', isNotBlank('Test'), true],
-        ['number', isNumber(1), true],
-        ['number', isNumber(''), false],
-        ['numberOrBlank', isNumberOrBlank(1), true],
-        ['numberOrBlank', isNumberOrBlank(''), true],
-        ['non number', isNumber('Test'), false],
-        ['positive number', isPositiveNumber(100), true],
-        ['non positive number', isPositiveNumber(-100), false],
-        ['positive number or zero', isPositiveNumberOrZero(0), true],
-        ['positive number or zero', isPositiveNumberOrZero(100), true],
-        ['positive number or zero allows blanks', isPositiveNumberOrZero(''), true],
-        ['not a positive number or zero', isPositiveNumberOrZero(-10), false],
-        ['valid date', isValidDate('2020-10-03'), true],
-        ['invalid date', isValidDate('2020-15-99'), false],
-        [
-            'file part matches',
-            matchesFilePart('projectId')('DOH', {}, validateContext),
-            true,
-        ],
-        [
-            'file part does not match',
-            matchesFilePart('projectId')('OMB', {}, validateContext),
-            false,
-        ],
-        [
-            'valid subrecipient',
-            isValidSubrecipient('1010', {}, validateContext),
-            true,
-        ],
-        [
-            'invalid subrecipient',
-            isValidSubrecipient('1020', {}, validateContext),
-            false,
-        ],
-        [
-            'sum is correct',
-            isSum(['amount1', 'amount2'])(
-                100.0,
-                { amount1: 40.0, amount2: 60.0 },
-                validateContext,
-            ),
-            true,
-        ],
-        [
-            'sum is not correct',
-            isSum(['amount1', 'amount2'])(
-                90.0,
-                { amount1: 40.0, amount2: 60.0 },
-                validateContext,
-            ),
-            false,
-        ],
-        [
-            'sum convert strings to float',
-            isSum(['amount1', 'amount2'])(
-                '100.0',
-                { amount1: '40.0', amount2: '60.0' },
-                validateContext,
-            ),
-            true,
-        ],
-        [
-            'number is less than or equal',
-            numberIsLessThanOrEqual('total')(100, { total: 200 }, validateContext),
-            true,
-        ],
-        [
-            'number is not less than or equal',
-            numberIsLessThanOrEqual('total')(500, { total: 200 }, validateContext),
-            false,
-        ],
-        [
-            'number is greater than or equal',
-            numberIsGreaterThanOrEqual('total')(
-                1000,
-                { total: 200 },
-                validateContext,
-            ),
-            true,
-        ],
-        [
-            'number is not greater than or equal',
-            numberIsGreaterThanOrEqual('total')(50, { total: 200 }, validateContext),
-            false,
-        ],
-        [
-            'date is in reporting period',
-            dateIsInReportingPeriod(43929, {}, validateContext),
-            true,
-        ],
-        [
-            'date is before reporting period',
-            dateIsInReportingPeriod(43800, {}, validateContext),
-            false,
-        ],
-        [
-            'date is after reporting period',
-            dateIsInReportingPeriod(44197, {}, validateContext),
-            false,
-        ],
-        [
-            'date is in period or performance',
-            dateIsInPeriodOfPerformance(44166, {}, validateContext),
-            true,
-        ],
-        [
-            'whenBlank conditional validation passes',
-            whenBlank('duns number', isNotBlank)(
-                '123',
-                { 'duns number': '' },
-                validateContext,
-            ),
-            true,
-        ],
-        [
-            'whenBlank conditional validation fails',
-            whenBlank('duns number', isNotBlank)(
-                '',
-                { 'duns number': '' },
-                validateContext,
-            ),
-            false,
-        ],
-        [
-            'whenBlank conditional validation ignored',
-            whenBlank('duns number', isNotBlank)(
-                '',
-                { 'duns number': '123' },
-                validateContext,
-            ),
-            true,
-        ],
-        [
-            'whenGreaterThanZero conditional validation passes',
-            whenGreaterThanZero(
-                'total expenditure amount',
-                dateIsInPeriodOfPerformance,
-            )(44166, { 'total expenditure amount': 1000.0 }, validateContext),
-            true,
-        ],
-        [
-            'whenGreaterThanZero conditional validation fails',
-            whenGreaterThanZero(
-                'total expenditure amount',
-                dateIsInPeriodOfPerformance,
-            )(45000, { 'total expenditure amount': 1000.0 }, validateContext),
-            false,
-        ],
-        [
-            'whenGreaterThanZero conditional validation ignored',
-            whenGreaterThanZero(
-                'total expenditure amount',
-                dateIsInPeriodOfPerformance,
-            )(45000, { 'total expenditure amount': '' }, validateContext),
-            true,
-        ],
-        [
-            'valid US zip passes',
-            isValidZip(
-                98101,
-                {},
-                validateContext,
-            ),
-            true,
-        ],
-        [
-            'valid US zip fails',
-            isValidZip(
-                981,
-                {},
-                validateContext,
-            ),
-            false,
-        ],
-        [
-            'whenUS conditional validation passes',
-            whenUS('country', isValidZip)(
-                98101,
-                { country: 'usa' },
-                validateContext,
-            ),
-            true,
-        ],
-        [
-            'whenUS conditional validation passes',
-            whenUS('country', isValidZip)(
-                98101,
-                { country: 'united states' },
-                validateContext,
-            ),
-            true,
-        ],
-        [
-            'whenUS conditional validation fails',
-            whenUS('country', isValidZip)(
-                981,
-                { country: 'usa' },
-                validateContext,
-            ),
-            false,
-        ],
-        [
-            'whenUS conditional validation fails',
-            whenUS('country', isValidZip)(
-                981,
-                { country: 'united states' },
-                validateContext,
-            ),
-            false,
-        ],
-        [
-            'whenUS conditional validation skipped',
-            whenUS('country', isValidZip)(
-                981,
-                { country: 'hk' },
-                validateContext,
-            ),
-            true,
-        ],
-        [
-            'whenUS conditional validation skipped',
-            whenUS('country', isValidZip)(
-                '',
-                { country: 'hk' },
-                validateContext,
-            ),
-            true,
-        ],
-        ['isAtLeast50K fails', isAtLeast50K(undefined), false],
-        ['isAtLeast50K fails', isAtLeast50K(''), false],
-        ['isAtLeast50K fails', isAtLeast50K(5000.00), false],
-        ['isAtLeast50K passes', isAtLeast50K(50000.00), true],
-        ['isAtLeast50K passes', isAtLeast50K(150000.00), true],
-
-        [
-            'cumulativeAmountIsEqual passes for obligation',
-            cumulativeAmountIsEqual('current quarter obligation', contractMatches)(
-                600.0,
-                { 'project id': '1', 'contract number': '1001', 'current quarter obligation': 300.0 },
-                validateContext,
-            ),
-            true,
-        ],
-        [
-            'cumulativeAmountIsEqual passes for expenditure',
-            cumulativeAmountIsEqual('total expenditure amount', contractMatches)(
-                60.0,
-                { 'project id': '1', 'contract number': '1001', 'total expenditure amount': 30.0 },
-                validateContext,
-            ),
-            true,
-        ],
-        [
-            'cumulativeAmountIsEqual fails',
-            cumulativeAmountIsEqual('current quarter obligation', contractMatches)(
-                200.0,
-                { 'current quarter obligation': 300.0 },
-                validateContext,
-            ),
-            false,
-        ],
-    ];
-    testCases.forEach(([name, b, expectedResult]) => {
-        it(`${name} should return ${expectedResult}`, () => {
-            expect(b).to.equal(expectedResult);
-        });
-    });
-    // isValidState() doesn't work in the testCases array,
-    // because it has to run after beforeEach() has initialized
-    // the dropdowns, so it has to be invoked inside an it() function.
-    it.skip('isValidState("WA") should return true', () => {
-        expect(isValidState('WA', {}, validateContext)).to.equal(true);
-    });
-    it.skip('isValidState("ZZ") should return false', () => {
-        expect(isValidState('ZZ', {}, validateContext)).to.equal(false);
-    });
-});
-
-describe('validateFields', () => {
-    const requiredFields = [
-        ['name', isNotBlank],
-        ['date', isValidDate],
-        ['description', isNotBlank, 'Description is required'],
-    ];
-    it('can validate a record', () => {
-        const content = {
-            name: 'George',
-            date: '2020-10-02',
-            description: 'testing',
-        };
-        const r = validateFields(requiredFields, content, 'Test', 1);
-        expect(r).to.have.length(0);
-    });
-    it('can report multiple errors, with custom message', () => {
-        const content = { name: '', date: '2020-10-02' };
-        const r = validateFields(requiredFields, content, 'Test', 5);
-        expect(r).to.have.length(2);
-        expect(r[0].info.message).to.equal('Empty or invalid entry for name: ""');
-        expect(r[0].info.tab).to.equal('Test');
-        expect(r[0].info.row).to.equal(5);
-        expect(r[1].info.message).to.equal('Description is required');
-        expect(r[1].info.tab).to.equal('Test');
-        expect(r[1].info.row).to.equal(5);
-    });
-});
-
-describe('can exclude filters based on tags', () => {
-    const requiredFields = [
-        ['name', isNotBlank, 'Name is required', { tags: ['v2'] }],
-    ];
-    const content = { name: '' };
-    it('includes filter with matching tag', () => {
-        const r = validateFields(
-            requiredFields,
-            content,
-            'Test Tab',
-            1,
-            { tags: ['v2'] },
-        );
-        expect(r).to.have.length(1);
-    });
-    it('ignores filter with non matching tag', () => {
-        const r = validateFields(
-            requiredFields,
-            content,
-            'Test Tab',
-            1,
-            { tags: ['v3'] },
-        );
-        expect(r).to.have.length(0);
-    });
-    it('ignores filter when context has no tags', () => {
-        const r = validateFields(requiredFields, content, 'Test Tab', 1, {});
-        expect(r).to.have.length(0);
-    });
-});
-
-describe('custom message', () => {
-    it('can include the invalid value in the message', () => {
-        const validations = [
-            ['type', (v) => v === 'FOO' || v === 'BAR', 'Type "{}" is not valid'],
-        ];
-        const content = { type: 'BAZ' };
-        const r = validateFields(validations, content, 'Test', 5);
-        expect(r).to.have.length(1);
-        expect(r[0].info.message).to.equal('Type "BAZ" is not valid');
-    });
-});
-
-describe('validateRecords', () => {
-    const records = {
-        test: [
-            { content: { name: 'George' } },
-            { content: { name: 'John' } },
-            { content: { name: 'Thomas' } },
-            { content: { name: 'James' } },
-            { content: { name: '' } },
-        ],
-    };
-    const validations = [['name', isNotBlank]];
-    it('can validate a collection of records', () => {
-        const log = validateRecords('test', validations)(records, {});
-        expect(log).to.have.length(1);
-    });
-});
-
-describe('date conversion for messages', () => {
-    it('can convert spreadsheet dates', () => {
-        expect(messageValue(44195, { isDateValue: true })).to.equal('12/30/2020');
-    });
-    it('only converts valid dates', () => {
-        expect(messageValue('Friday', { isDateValue: true })).to.equal('Friday');
-    });
-    it('only converts dates', () => {
-        expect(messageValue(44195)).to.equal(44195);
-    });
-});
-
-/*                                 *  *  *                                    */
-
-// NOTE: This file was copied from tests/server/services/validate-data/validate.spec.js (git @ ada8bfdc98) in the arpa-reporter repo on 2022-09-23T20:05:47.735Z
diff --git a/packages/server/__tests__/db/seeds/fixtures.js b/packages/server/__tests__/db/seeds/fixtures.js
index ee3c303a1..8f0a93a97 100644
--- a/packages/server/__tests__/db/seeds/fixtures.js
+++ b/packages/server/__tests__/db/seeds/fixtures.js
@@ -117,7 +117,7 @@ const grants = {
         search_terms: '[in title/desc]+',
         reviewer_name: 'none',
         opportunity_category: 'Discretionary',
-        description: '<p class="MsoNormal">The Division of Earth Sciences (EAR) awards Postdoctoral Fellowships </p>',
+        description: 'The Division of Earth Sciences (EAR) awards Postdoctoral Fellowships',
         eligibility_codes: '25',
         opportunity_status: 'posted',
         raw_body: 'raw body',
@@ -141,7 +141,7 @@ const grants = {
         search_terms: '[in title/desc]+',
         reviewer_name: 'none',
         opportunity_category: 'Discretionary',
-        description: ' <p>Health Aide Program for Covid</p>',
+        description: ' Health Aide Program for Covid',
         eligibility_codes: '11 07 25',
         opportunity_status: 'posted',
         raw_body: 'raw body',
@@ -165,7 +165,7 @@ const grants = {
         search_terms: '[in title/desc]+',
         reviewer_name: 'none',
         opportunity_category: 'Discretionary',
-        description: '<p class="MsoNormal">The Tactical Technology Office (TTO) of the Defense Advanced Research Projects Agency (DARPA) </p>',
+        description: 'The Tactical Technology Office (TTO) of the Defense Advanced Research Projects Agency (DARPA)',
         eligibility_codes: '11',
         opportunity_status: 'posted',
         raw_body: 'raw body',
diff --git a/packages/server/__tests__/email/email.test.js b/packages/server/__tests__/email/email.test.js
index 625baca46..e58c1be56 100644
--- a/packages/server/__tests__/email/email.test.js
+++ b/packages/server/__tests__/email/email.test.js
@@ -364,13 +364,15 @@ describe('Email sender', () => {
             const agencies = await db.getAgency(fixtures.agencies.accountancy.id);
             const agency = agencies[0];
             agency.matched_grants = [fixtures.grants.healthAide];
-            const body = await email.buildDigestBody(agency.matched_grants);
+            const body = await email.buildDigestBody({ name: 'Saved search test', openDate: '2021-08-05', matchedGrants: agency.matched_grants });
             expect(body).to.include(fixtures.grants.healthAide.description);
         });
         it('builds only first 3 grants if >3 available', async () => {
             const agencies = await db.getAgency(fixtures.agencies.accountancy.id);
             const agency = agencies[0];
             const ignoredGrant = { ...fixtures.grants.healthAide };
+            const name = 'Saved search test';
+            const openDate = moment().subtract(1, 'day').format('YYYY-MM-DD');
             ignoredGrant.description = 'Added a brand new description';
 
             const updateFn = (int) => {
@@ -380,7 +382,7 @@ describe('Email sender', () => {
             };
             const additionalGrants = [...Array(30).keys()].map(updateFn);
             agency.matched_grants = [...additionalGrants, ...[fixtures.grants.healthAide, fixtures.grants.earFellowship, fixtures.grants.redefiningPossible]];
-            const body = await email.buildDigestBody(agency.matched_grants);
+            const body = await email.buildDigestBody({ name, openDate, matchedGrants: agency.matched_grants });
 
             /* the last 3 grants should not be included in the email */
             expect(body).to.not.include(fixtures.grants.healthAide.description);
@@ -389,6 +391,8 @@ describe('Email sender', () => {
 
             /* the first 30 grants should be included in the email */
             additionalGrants.forEach((grant) => expect(body).to.include(grant.description));
+            expect(body).to.include(name);
+            expect(body).to.include(moment(openDate).format('MMMM Do YYYY'));
         });
     });
     context('getAndSendGrantForSavedSearch', () => {
diff --git a/packages/server/src/arpa_reporter/services/validate-data/certification.js b/packages/server/src/arpa_reporter/services/validate-data/certification.js
deleted file mode 100644
index 99bbe0039..000000000
--- a/packages/server/src/arpa_reporter/services/validate-data/certification.js
+++ /dev/null
@@ -1,19 +0,0 @@
-const { isNotBlank, isValidDate } = require('./validate');
-const { validateSingleRecord } = require('./validate');
-
-const requiredFields = [
-    [
-        'agency financial reviewer name',
-        isNotBlank,
-        'Agency financial reviewer name must not be blank',
-    ],
-    ['date', isValidDate, 'Date must be a valid date', { isDate: true }],
-];
-
-module.exports = validateSingleRecord(
-    'certification',
-    requiredFields,
-    'certification requires a row with "agency financial reviewer name" and "date"',
-);
-
-// NOTE: This file was copied from src/server/services/validate-data/certification.js (git @ ada8bfdc98) in the arpa-reporter repo on 2022-09-23T20:05:47.735Z
diff --git a/packages/server/src/arpa_reporter/services/validate-data/contracts.js b/packages/server/src/arpa_reporter/services/validate-data/contracts.js
deleted file mode 100644
index f5d938739..000000000
--- a/packages/server/src/arpa_reporter/services/validate-data/contracts.js
+++ /dev/null
@@ -1,238 +0,0 @@
-const {
-    contractMatches,
-    cumulativeAmountIsEqual,
-    cumulativeAmountIsLessThanOrEqual,
-    dateIsInPeriodOfPerformance,
-    dateIsInReportingPeriod,
-    dateIsOnOrBefore,
-    dateIsOnOrBeforeCRFEndDate,
-    dropdownIncludes,
-    isEqual,
-    isAtLeast50K,
-    isNotBlank,
-    isNumber,
-    isNumberOrBlank,
-    isPositiveNumberOrZero,
-    isSum,
-    isValidDate,
-    isValidState,
-    isValidSubrecipient,
-    isValidZip,
-    matchesFilePart,
-    numberIsLessThanOrEqual,
-    validateRecords,
-    whenGreaterThanZero,
-    whenNotBlank,
-    whenUS,
-} = require('./validate');
-
-const expenditureCategories = require('./expenditure-categories');
-
-// type pattern for this elements of the fields array is
-// [
-//   columnName: string,
-//   validator: (val: any, content: obj?) => bool,
-//   message: string?
-// ]
-const requiredFields = [
-    [
-        'project id',
-        matchesFilePart('projectId'),
-        'The contract project id "{}" does not match the project id in the filename',
-    ],
-    [
-        'subrecipient id',
-        isValidSubrecipient,
-        'Each contract row must have a "subrecipient id" which is included in the "subrecipient" tab',
-    ],
-    [
-        'period of performance end date',
-        isValidDate,
-        'Period of performance end date "{}" is not a valid date',
-        { isDateValue: true },
-    ],
-    [
-        'period of performance start date',
-        dateIsInPeriodOfPerformance,
-        'Period of performance start date "{}" must be in the period of performance',
-        { isDateValue: true },
-    ],
-    [
-        'period of performance end date',
-        dateIsOnOrBeforeCRFEndDate,
-        'Period of performance end date "{}" must be on or before CRF end date',
-        { isDateValue: true },
-    ],
-    ['contract number', isNotBlank, 'Contract number cannot be blank'],
-    [
-        'contract type',
-        dropdownIncludes('contract type'),
-        'Contract type is not valid',
-    ],
-    [
-        'contract amount',
-        isPositiveNumberOrZero,
-        'Contract {{contract number}} contract amount must be an amount greater than or equal to zero',
-    ],
-    [
-        'contract amount',
-        isEqual('current quarter obligation'),
-        'Contract amount must equal obligation amount',
-        { tags: ['v2'] },
-    ],
-    [
-        'contract amount',
-        cumulativeAmountIsEqual('current quarter obligation', contractMatches),
-        'Contract {{contract number}} contract amount must equal cumulative obligation amount',
-        { tags: ['cumulative'] },
-    ],
-    [
-        'contract amount',
-        isAtLeast50K,
-        'Contract amount must be at least $50,000',
-        { tags: ['v2'] },
-    ],
-
-    [
-        'contract date',
-        isValidDate,
-        'Contract date "{}" is not valid',
-        { isDateValue: true },
-    ],
-    [
-        'contract date',
-        dateIsInReportingPeriod,
-        'Contract date "{}" is not in reporting report',
-        { isDateValue: true },
-    ],
-    [
-        'contract date',
-        dateIsInPeriodOfPerformance,
-        'Contract date "{}" must be in the period of performance',
-        { isDateValue: true },
-    ],
-    [
-        'contract date',
-        whenGreaterThanZero(
-            'total expenditure amount',
-            dateIsOnOrBefore('expenditure start date'),
-        ),
-        'Contract date "{}" must be on or before the expenditure start date',
-        { isDateValue: true },
-    ],
-
-    [
-        'period of performance start date',
-        isValidDate,
-        'Period of performance start date "{}" is not valid',
-        { isDateValue: true },
-    ],
-    [
-        'period of performance start date',
-        dateIsOnOrBefore('period of performance end date'),
-        'Period of performance start date "{}" must be on or before the period of performance end date',
-        { isDateValue: true },
-    ],
-
-    [
-        'expenditure start date',
-        whenGreaterThanZero('total expenditure amount', isValidDate),
-        'Expenditure state date "{}" is not a valid date',
-        { isDateValue: true },
-    ],
-    [
-        'expenditure start date',
-        whenGreaterThanZero('total expenditure amount', dateIsInReportingPeriod),
-        'Expenditure state date "{}" is not in the reporting period',
-        { isDateValue: true },
-    ],
-    [
-        'expenditure start date',
-        whenGreaterThanZero(
-            'total expenditure amount',
-            dateIsOnOrBefore('expenditure end date'),
-        ),
-        'Expenditure start date "{}" must be before expenditure end date',
-        { isDateValue: true },
-    ],
-
-    [
-        'expenditure end date',
-        whenGreaterThanZero('total expenditure amount', isValidDate),
-        'Expenditure end date "{}" is not a valid date',
-        { isDateValue: true },
-    ],
-    [
-        'expenditure end date',
-        whenGreaterThanZero('total expenditure amount', dateIsInReportingPeriod),
-        'Expenditure end date "{}" must be in the reporting period',
-        { isDateValue: true },
-    ],
-
-    [
-        'primary place of performance address line 1',
-        isNotBlank,
-        'Primary place of performance address line 1 cannot be blank',
-    ],
-    [
-        'primary place of performance city name',
-        isNotBlank,
-        'Primary place of performance city name cannot be blank',
-    ],
-    [
-        'primary place of performance state code',
-        isValidState,
-        'Primary place of performance state code "{}" is not valid',
-    ],
-    [
-        'primary place of performance zip',
-        whenUS('primary place of performance country name', isValidZip),
-        'Primary place of performance zip "{}" is not valid',
-    ],
-    [
-        'primary place of performance country name',
-        dropdownIncludes('country'),
-        'Primary place of performance country name "{}" is not valid',
-    ],
-    [
-        'current quarter obligation',
-        isNumberOrBlank,
-
-        'Contract {{contract number}} current quarter obligation must be an amount greater than zero',
-    ],
-    [
-        'current quarter obligation',
-        whenNotBlank('current quanter obligation', numberIsLessThanOrEqual('contract amount')),
-        'Contract {{contract number}} current quarter obligation {{current quarter obligation}} must be less than or equal to the contract amount',
-    ],
-    [
-        'total expenditure amount',
-        isNumberOrBlank,
-        'Total expenditure amount must be a number',
-    ],
-    [
-        'total expenditure amount',
-        isSum(expenditureCategories),
-        'Total expenditure amount must be the sum of all expenditure amount columns',
-    ],
-    [
-        'contract amount',
-        cumulativeAmountIsLessThanOrEqual('total expenditure amount', contractMatches),
-        'Cumulative expenditure amount must be less than or equal to contract amount',
-        { tags: ['cumulative'] },
-    ],
-    [
-        'other expenditure categories',
-        whenNotBlank('other expenditure amount', isNotBlank),
-        'Other Expenditure Categories cannot be blank if Other Expenditure Amount has an amount',
-    ],
-    [
-        'other expenditure amount',
-        whenNotBlank('other expenditure categories', isNumber),
-        'Other Expenditure Amount must be a number',
-    ],
-];
-
-module.exports = validateRecords('contracts', requiredFields);
-
-// NOTE: This file was copied from src/server/services/validate-data/contracts.js (git @ ada8bfdc98) in the arpa-reporter repo on 2022-09-23T20:05:47.735Z
diff --git a/packages/server/src/arpa_reporter/services/validate-data/cover.js b/packages/server/src/arpa_reporter/services/validate-data/cover.js
deleted file mode 100644
index c44d32166..000000000
--- a/packages/server/src/arpa_reporter/services/validate-data/cover.js
+++ /dev/null
@@ -1,18 +0,0 @@
-const { matchesFilePart } = require('./validate');
-const { validateSingleRecord } = require('./validate');
-
-const requiredFields = [
-    [
-        'agency code',
-        matchesFilePart('agencyCode'),
-        'The agency code "{}" in the file name does not match the cover\'s agency code',
-    ],
-];
-
-module.exports = validateSingleRecord(
-    'cover',
-    requiredFields,
-    'cover requires a row with "agency code"',
-);
-
-// NOTE: This file was copied from src/server/services/validate-data/cover.js (git @ ada8bfdc98) in the arpa-reporter repo on 2022-09-23T20:05:47.735Z
diff --git a/packages/server/src/arpa_reporter/services/validate-data/direct.js b/packages/server/src/arpa_reporter/services/validate-data/direct.js
deleted file mode 100644
index 14995db16..000000000
--- a/packages/server/src/arpa_reporter/services/validate-data/direct.js
+++ /dev/null
@@ -1,119 +0,0 @@
-const {
-    directMatches,
-    cumulativeAmountIsEqual,
-    cumulativeAmountIsLessThanOrEqual,
-    dateIsInReportingPeriod,
-    dateIsOnOrBefore,
-    isAtLeast50K,
-    isNumberOrBlank,
-    isSum,
-    isValidDate,
-    isValidSubrecipient,
-    matchesFilePart,
-    numberIsLessThanOrEqual,
-    validateRecords,
-    whenGreaterThanZero,
-    whenNotBlank,
-} = require('./validate');
-
-const expenditureCategories = require('./expenditure-categories');
-
-// type pattern for this elements of the fields array is
-// [
-//   columnName: string,
-//   validator: (val: any, content: obj?) => bool,
-//   message: string?
-// ]
-const requiredFields = [
-    [
-        'project id',
-        matchesFilePart('projectId'),
-        'The direct project id "{}" does not match the project id in the filename',
-    ],
-
-    [
-        'subrecipient id',
-        isValidSubrecipient,
-        'Each direct row must have a "subrecipient id" which is included in the "subrecipient" tab',
-    ],
-
-    [
-        'obligation amount',
-        isAtLeast50K,
-        'Obligation amount must be at least $50,000',
-        { tags: ['v2'] },
-    ],
-
-    ['obligation date', isValidDate, 'Obligation date "{}" is not valid'],
-    [
-        'obligation date',
-        dateIsInReportingPeriod,
-        'Obligation date "{}" is not in the reporting period',
-        { isDateValue: true },
-    ],
-
-    [
-        'current quarter obligation',
-        isNumberOrBlank,
-        'Current quarter obligation must be an amount',
-    ],
-    [
-        'current quarter obligation',
-        whenNotBlank('current quarter obligation', numberIsLessThanOrEqual('obligation amount')),
-        'Current quarter obligation must be less than or equal to obligation amount',
-    ],
-    [
-        'obligation amount',
-        cumulativeAmountIsEqual('current quarter obligation', directMatches),
-        'Obligation amount must equal cumulative obligation amount',
-        { tags: ['cumulative'] },
-    ],
-    [
-        'expenditure start date',
-        whenGreaterThanZero('total expenditure amount', isValidDate),
-        'Expenditure start date "{}" is not valid',
-        { isDateValue: true },
-    ],
-    [
-        'expenditure start date',
-        whenGreaterThanZero('total expenditure amount', dateIsInReportingPeriod),
-        'Expenditure state date "{}" is not in the reporting period',
-        { isDateValue: true },
-    ],
-    [
-        'expenditure start date',
-        whenGreaterThanZero(
-            'total expenditure amount',
-            dateIsOnOrBefore('expenditure end date'),
-        ),
-        'Expenditure start date "{}" is not on or before the expenditure end date',
-        { isDateValue: true },
-    ],
-    [
-        'expenditure start date',
-        whenGreaterThanZero('total expenditure amount', dateIsInReportingPeriod),
-        'Expenditure start date "{}" is not in the reporting period',
-        { isDateValue: true },
-    ],
-
-    [
-        'total expenditure amount',
-        isNumberOrBlank,
-        'Total expenditure amount must be a number',
-    ],
-    [
-        'total expenditure amount',
-        isSum(expenditureCategories),
-        'Total expenditure amount is not the sum of all expenditure amount columns',
-    ],
-    [
-        'obligation amount',
-        cumulativeAmountIsLessThanOrEqual('total expenditure amount', directMatches),
-        'Cumulative expenditure amount must be less than or equal to obligation amount',
-        { tags: ['cumulative'] },
-    ],
-];
-
-module.exports = validateRecords('direct', requiredFields);
-
-// NOTE: This file was copied from src/server/services/validate-data/direct.js (git @ ada8bfdc98) in the arpa-reporter repo on 2022-09-23T20:05:47.735Z
diff --git a/packages/server/src/arpa_reporter/services/validate-data/expenditure-categories.js b/packages/server/src/arpa_reporter/services/validate-data/expenditure-categories.js
deleted file mode 100644
index 6eb6aa7b2..000000000
--- a/packages/server/src/arpa_reporter/services/validate-data/expenditure-categories.js
+++ /dev/null
@@ -1,24 +0,0 @@
-const expenditureCategories = [
-    'budgeted personnel and services diverted to a substantially different use',
-    'covid-19 testing and contact tracing',
-    'economic support (other than small business, housing, and food assistance)',
-    'facilitating distance learning',
-    'food programs',
-    'housing support',
-    'improve telework capabilities of public employees',
-    'medical expenses',
-    'nursing home assistance',
-    'payroll for public health and safety employees',
-    'personal protective equipment',
-    'public health expenses',
-    'small business assistance',
-    'unemployment benefits',
-    'workers’ compensation',
-    'expenses associated with the issuance of tax anticipation notes',
-    'administrative expenses',
-    'other expenditure amount',
-];
-
-module.exports = expenditureCategories;
-
-// NOTE: This file was copied from src/server/services/validate-data/expenditure-categories.js (git @ ada8bfdc98) in the arpa-reporter repo on 2022-09-23T20:05:47.735Z
diff --git a/packages/server/src/arpa_reporter/services/validate-data/grants.js b/packages/server/src/arpa_reporter/services/validate-data/grants.js
deleted file mode 100644
index 9a4987607..000000000
--- a/packages/server/src/arpa_reporter/services/validate-data/grants.js
+++ /dev/null
@@ -1,235 +0,0 @@
-const {
-    cumulativeAmountIsEqual,
-    cumulativeAmountIsLessThanOrEqual,
-    dateIsInPeriodOfPerformance,
-    dateIsInReportingPeriod,
-    dateIsOnOrBefore,
-    dateIsOnOrBeforeCRFEndDate,
-    dropdownIncludes,
-    grantMatches,
-    isEqual,
-    isAtLeast50K,
-    isNotBlank,
-    isNumber,
-    isNumberOrBlank,
-    isSum,
-    isValidDate,
-    isValidState,
-    isValidSubrecipient,
-    isValidZip,
-    matchesFilePart,
-    numberIsLessThanOrEqual,
-    validateRecords,
-    whenGreaterThanZero,
-    whenNotBlank,
-    whenUS,
-} = require('./validate');
-
-const expenditureCategories = require('./expenditure-categories');
-
-// type pattern for this elements of the fields array is
-// [
-//   columnName: string,
-//   validator: (val: any, content: obj?) => bool,
-//   message: string?
-// ]
-const requiredFields = [
-    [
-        'project id',
-        matchesFilePart('projectId'),
-        'The grant project id "{}" does not match the project id in the filename',
-    ],
-    [
-        'subrecipient id',
-        isValidSubrecipient,
-        'Each grant row must have a "subrecipient id" which is included in the "subrecipient" tab',
-    ],
-    ['award number', isNotBlank, 'Award number must not be blank'],
-    [
-        'award payment method',
-        dropdownIncludes('award payment method'),
-        'Award payment method "{}" is not valid',
-    ],
-    [
-        'award amount',
-        isAtLeast50K,
-        'Contract amount must be at least $50,000',
-        { tags: ['v2'] },
-    ],
-
-    ['award date', isValidDate, 'Award date must be a valid date'],
-    [
-        'award date',
-        dateIsOnOrBefore('period of performance start date'),
-        'Award date "{}" is not on or before the period of performance start date',
-        { isDateValue: true },
-    ],
-    [
-        'award date',
-        whenGreaterThanZero(
-            'total expenditure amount',
-            dateIsOnOrBefore('expenditure start date'),
-        ),
-        'Award date "{}" is not on or before the expenditure start date',
-        { isDateValue: true },
-    ],
-    [
-        'award date',
-        dateIsInReportingPeriod,
-        'Award date "{}" is not in the reporting period',
-        { isDateValue: true },
-    ],
-
-    [
-        'period of performance start date',
-        whenGreaterThanZero('total expenditure amount', isValidDate),
-        'Period of performance start date "{}" is not a valid date',
-        { isDateValue: true },
-    ],
-    [
-        'period of performance start date',
-        dateIsInPeriodOfPerformance,
-        'Period of performance start date "{}" must be in the period of performance',
-        { isDateValue: true },
-    ],
-    [
-        'period of performance end date',
-        whenGreaterThanZero('total expenditure amount', isValidDate),
-        'Period of performance end date "{}" is not a valid date',
-        { isDateValue: true },
-    ],
-    [
-        'period of performance end date',
-        whenGreaterThanZero(
-            'total expenditure amount',
-            dateIsOnOrBeforeCRFEndDate,
-        ),
-        'Period of performance end date "{}" must be on or before CRF end date',
-        { isDateValue: true },
-    ],
-    [
-        'period of performance start date',
-        whenGreaterThanZero(
-            'total expenditure amount',
-            dateIsOnOrBefore('period of performance end date'),
-        ),
-        'period of performance start date "{}" is not on or before period of performance end date',
-        { isDateValue: true },
-    ],
-
-    [
-        'expenditure start date',
-        whenGreaterThanZero('total expenditure amount', isValidDate),
-        'Expenditure start date "{}" is not a valid date',
-        { isDateValue: true },
-    ],
-    [
-        'expenditure start date',
-        whenGreaterThanZero('total expenditure amount', dateIsInReportingPeriod),
-        'Expenditure state date "{}" is not in the reporting period',
-        { isDateValue: true },
-    ],
-    [
-        'expenditure start date',
-        whenGreaterThanZero(
-            'total expenditure amount',
-            dateIsOnOrBefore('expenditure end date'),
-        ),
-        'Expenditure start date "{}" is not on or before the expenditure end date',
-        { isDateValue: true },
-    ],
-    [
-        'expenditure end date',
-        whenGreaterThanZero('total expenditure amount', isValidDate),
-        'Expenditure end date "{}" is not a valid date',
-    ],
-
-    [
-        'primary place of performance address line 1',
-        isNotBlank,
-        'primary place of performance address line 1 must not be blank',
-    ],
-    [
-        'primary place of performance city name',
-        isNotBlank,
-        'primary place of performance city must not be blank',
-    ],
-    [
-        'primary place of performance state code',
-        isValidState,
-        'primary place of performance state is not valid',
-    ],
-    [
-        'primary place of performance zip',
-        whenUS('primary place of performance country name', isValidZip),
-        'primary place of performance zip must not be blank',
-    ],
-    [
-        'primary place of performance country name',
-        dropdownIncludes('country'),
-        'primary place of performance country name "{}" is not valid',
-    ],
-
-    [
-        'compliance',
-        dropdownIncludes(
-            'is awardee complying with terms and conditions of the grant?',
-        ),
-        'Compliance "{}" is not valid',
-    ],
-
-    [
-        'current quarter obligation',
-        isNumberOrBlank,
-        'Current quarter obligation must be an amount',
-    ],
-    [
-
-        'current quarter obligation',
-        whenNotBlank('current quarter obligation', numberIsLessThanOrEqual('award amount')),
-        'Award {{award number}}: current quarter obligation quarter obligation must be less than or equal to award amount',
-    ],
-    [
-        'award amount',
-        isEqual('current quarter obligation'),
-        'Award amount must equal obligation amount',
-        { tags: ['v2'] },
-    ],
-    [
-        'award amount',
-        cumulativeAmountIsEqual('current quarter obligation', grantMatches),
-        'Award {{award number}}: award amount {{award amount}} must equal cumulative obligation amount {{cumulative obligation amount}} for award',
-        { tags: ['cumulative'] },
-    ],
-
-    [
-        'total expenditure amount',
-        isNumberOrBlank,
-        'Total expenditure amount must be an amount',
-    ],
-    [
-        'total expenditure amount',
-        isSum(expenditureCategories),
-        'Total expenditure amount is not the sum of all expenditure amount columns',
-    ],
-    [
-        'award amount',
-        cumulativeAmountIsLessThanOrEqual('total expenditure amount', grantMatches),
-        'Cumulative expenditure amount must be less than or equal to award amount',
-        { tags: ['cumulative'] },
-    ],
-    [
-        'other expenditure categories',
-        whenNotBlank('other expenditure amount', isNotBlank),
-        'Other Expenditure Categories cannot be blank if Other Expenditure Amount has an amount',
-    ],
-    [
-        'other expenditure amount',
-        whenNotBlank('other expenditure categories', isNumber),
-        'Other Expenditure Amount must be a number',
-    ],
-];
-
-module.exports = validateRecords('grants', requiredFields);
-
-// NOTE: This file was copied from src/server/services/validate-data/grants.js (git @ ada8bfdc98) in the arpa-reporter repo on 2022-09-23T20:05:47.735Z
diff --git a/packages/server/src/arpa_reporter/services/validate-data/helpers.js b/packages/server/src/arpa_reporter/services/validate-data/helpers.js
deleted file mode 100644
index c6411f3bc..000000000
--- a/packages/server/src/arpa_reporter/services/validate-data/helpers.js
+++ /dev/null
@@ -1,40 +0,0 @@
-const _ = require('lodash');
-
-const subrecipientKey = (subrecipient) => (
-    // keep duns number first or tests fail
-    // console.log(`subrecipientKey()`)
-    // console.dir(subrecipient)
-    subrecipient['duns number'] || subrecipient['identification number']
-);
-
-/* getSubrecipientsHash() returns a KV table where k is the subrecipient id
-  and v is the subrecipient record:
-  { '48262': {
-      type: 'subrecipient',
-      user_id: 1,
-      content: {
-        'identification number': '48262',
-        'duns number': undefined,
-        'legal name': 'HOLOGIC INC',
-        'address line 1': '250 CAMPUS DR',
-        'address line 2': undefined,
-        'address line 3': undefined,
-        'city name': 'MARLBOROUGH',
-        'state code': 'MA',
-        zip: '01752',
-        'country name': 'United States',
-        'organization type': 'County Government'
-      },
-      sourceRow: 3
-    },
-    ...
-  }
-  */
-const getSubrecipientsHash = (subrecipientRecords) => _.keyBy(subrecipientRecords, ({ content }) => subrecipientKey(content));
-
-module.exports = {
-    subrecipientKey,
-    getSubrecipientsHash,
-};
-
-// NOTE: This file was copied from src/server/services/validate-data/helpers.js (git @ ada8bfdc98) in the arpa-reporter repo on 2022-09-23T20:05:47.735Z
diff --git a/packages/server/src/arpa_reporter/services/validate-data/index.js b/packages/server/src/arpa_reporter/services/validate-data/index.js
deleted file mode 100644
index 1942b1eeb..000000000
--- a/packages/server/src/arpa_reporter/services/validate-data/index.js
+++ /dev/null
@@ -1,44 +0,0 @@
-const _ = require('lodash');
-const { format } = require('date-fns');
-
-const { getSubrecipientsHash } = require('./helpers');
-
-/* eslint-disable global-require */
-const tabValidators = [
-    require('./certification'),
-    require('./cover'),
-    // require('./subrecipients'),
-    // require('./contracts'),
-    // require('./grants'),
-    // require('./loans'),
-    // require('./transfers'),
-    // require('./direct')
-];
-/* eslint-enable global-require */
-
-const validateData = (records, fileParts, reportingPeriod, periodSummaries, firstReportingPeriodStartDate) => {
-    const groupedRecords = _.groupBy(records, 'type');
-    const subrecipientsHash = getSubrecipientsHash(groupedRecords.subrecipient);
-
-    const validateContext = {
-        fileParts,
-        firstReportingPeriodStartDate: format(firstReportingPeriodStartDate, 'yyyy-MM-dd'),
-        reportingPeriod: {
-            startDate: format(reportingPeriod.start_date, 'yyyy-MM-dd'),
-            endDate: format(reportingPeriod.end_date, 'yyyy-MM-dd'),
-            periodOfPerformanceEndDate: format(
-                reportingPeriod.period_of_performance_end_date,
-                'yyyy-MM-dd',
-            ),
-            crfEndDate: format(reportingPeriod.crf_end_date, 'yyyy-MM-dd'),
-        },
-        subrecipientsHash,
-        tags: reportingPeriod.validation_rule_tags,
-        periodSummaries,
-    };
-    return _.flatMap(tabValidators, (tabValidator) => _.take(tabValidator(groupedRecords, validateContext), 100));
-};
-
-module.exports = { validateData };
-
-// NOTE: This file was copied from src/server/services/validate-data/index.js (git @ ada8bfdc98) in the arpa-reporter repo on 2022-09-23T20:05:47.735Z
diff --git a/packages/server/src/arpa_reporter/services/validate-data/loans.js b/packages/server/src/arpa_reporter/services/validate-data/loans.js
deleted file mode 100644
index 255edf49c..000000000
--- a/packages/server/src/arpa_reporter/services/validate-data/loans.js
+++ /dev/null
@@ -1,110 +0,0 @@
-const {
-    cumulativeAmountIsEqual,
-    dateIsInReportingPeriod,
-    dropdownIncludes,
-    isNotBlank,
-    isNumberOrBlank,
-    isPositiveNumberOrZero,
-    isValidDate,
-    isValidState,
-    isValidSubrecipient,
-    isValidZip,
-    loanMatches,
-    matchesFilePart,
-    numberIsLessThanOrEqual,
-    validateRecords,
-    whenNotBlank,
-    whenUS,
-} = require('./validate');
-
-// type pattern for this elements of the fields array is
-// [
-//   columnName: string,
-//   validator: (val: any, content: obj?) => bool,
-//   message: string?
-// ]
-const requiredFields = [
-    [
-        'project id',
-        matchesFilePart('projectId'),
-        'The loan project id "{}" does not match the project id in the filename',
-    ],
-    [
-        'subrecipient id',
-        isValidSubrecipient,
-        'Each loan row must have a "subrecipient id" which is included in the "subrecipient" tab',
-    ],
-
-    ['loan number', isNotBlank, 'Load number must not be blank'],
-    [
-
-        'loan amount',
-        isPositiveNumberOrZero,
-        'Loan amount must be a number greater than or equal to zero',
-    ],
-    ['loan date', isValidDate, 'Loan date must be a valid date'],
-    [
-        'loan date',
-        dateIsInReportingPeriod,
-        'Loan date "{}" is not in the reporting period',
-        { isDateValue: true },
-    ],
-
-    [
-        'primary place of performance address line 1',
-        isNotBlank,
-        'primary place of business address line 1 must not be blank ',
-    ],
-    [
-        'primary place of performance city name',
-        isNotBlank,
-        'primary place of business city name must not be blank ',
-    ],
-    [
-        'primary place of performance state code',
-        isValidState,
-        'primary place of business state code must not be blank ',
-    ],
-    [
-        'primary place of performance zip',
-        whenUS('primary place of performance country name', isValidZip),
-        'primary place of business zip is not valid',
-    ],
-    [
-        'primary place of performance country name',
-        dropdownIncludes('country'),
-        'primary place of business country name "{}" is not valid',
-    ],
-
-    [
-        'current quarter obligation',
-        isNumberOrBlank,
-        'Current quarter obligation must be an amount',
-    ],
-    [
-        'current quarter obligation',
-        whenNotBlank('current quarter obligation', numberIsLessThanOrEqual('loan amount')),
-        'Current quarter obligation must be less than or equal to loan amount',
-    ],
-    [
-        'loan amount',
-        cumulativeAmountIsEqual('current quarter obligation', loanMatches),
-        'Loan amount must equal cumulative obligation amount',
-        { tags: ['cumulative'] },
-    ],
-    [
-        'payment amount',
-        whenNotBlank('payment amount', isNumberOrBlank),
-        'Payment amount must be a number',
-    ],
-    [
-        'payment date',
-        whenNotBlank('payment amount', isValidDate),
-        'Payment date must be a valid date',
-        { isDateValue: true },
-    ],
-];
-
-module.exports = validateRecords('loans', requiredFields);
-
-// NOTE: This file was copied from src/server/services/validate-data/loans.js (git @ ada8bfdc98) in the arpa-reporter repo on 2022-09-23T20:05:47.735Z
diff --git a/packages/server/src/arpa_reporter/services/validate-data/subrecipients.js b/packages/server/src/arpa_reporter/services/validate-data/subrecipients.js
deleted file mode 100644
index e24d92e40..000000000
--- a/packages/server/src/arpa_reporter/services/validate-data/subrecipients.js
+++ /dev/null
@@ -1,54 +0,0 @@
-const {
-    dropdownIncludes,
-    hasSubrecipientKey,
-    isNotBlank,
-    isValidState,
-    isValidZip,
-    validateRecords,
-    whenBlank,
-    whenUS,
-} = require('./validate');
-
-const requiredFields = [
-    [
-        '',
-        hasSubrecipientKey,
-        'Each subrecipient must have either an "identification number" or a "duns number"',
-    ],
-    ['legal name', isNotBlank, 'Legal name must not be blank'],
-    [
-        'organization type',
-        dropdownIncludes('organization type'),
-        'Organization type "{}" is not valid',
-    ],
-
-    [
-        'address line 1',
-        whenBlank('duns number', isNotBlank),
-        'Address line 1 must not be blank when DUNS number is not provided',
-    ],
-    [
-        'city name',
-        whenBlank('duns number', isNotBlank),
-        'City name must not be blank when DUNS number is not provided',
-    ],
-    [
-        'state code',
-        whenBlank('duns number', whenUS('country name', isValidState)),
-        'State code must be a valid state code when DUNS number is not provided',
-    ],
-    [
-        'zip',
-        whenBlank('duns number', whenUS('country name', isValidZip)),
-        'Zip must be a valid zip when DUNS number is not provided',
-    ],
-    [
-        'country name',
-        whenBlank('duns number', dropdownIncludes('country')),
-        'Country name must be a valid country name when DUNS number is not provided',
-    ],
-];
-
-module.exports = validateRecords('subrecipient', requiredFields);
-
-// NOTE: This file was copied from src/server/services/validate-data/subrecipients.js (git @ ada8bfdc98) in the arpa-reporter repo on 2022-09-23T20:05:47.735Z
diff --git a/packages/server/src/arpa_reporter/services/validate-data/transfers.js b/packages/server/src/arpa_reporter/services/validate-data/transfers.js
deleted file mode 100644
index c6f4364f0..000000000
--- a/packages/server/src/arpa_reporter/services/validate-data/transfers.js
+++ /dev/null
@@ -1,155 +0,0 @@
-const {
-    cumulativeAmountIsEqual,
-    cumulativeAmountIsLessThanOrEqual,
-    dateIsInReportingPeriod,
-    dateIsOnOrBefore,
-    dropdownIncludes,
-    isEqual,
-    isAtLeast50K,
-    isNotBlank,
-    isNumber,
-    isNumberOrBlank,
-    isSum,
-    isValidDate,
-    isValidSubrecipient,
-    matchesFilePart,
-    numberIsLessThanOrEqual,
-    transferMatches,
-    validateRecords,
-    whenNotBlank,
-    whenGreaterThanZero,
-} = require('./validate');
-
-const expenditureCategories = require('./expenditure-categories');
-
-// type pattern for this elements of the fields array is
-// [
-//   columnName: string,
-//   validator: (val: any, content: obj?) => bool,
-//   message: string?
-// ]
-const requiredFields = [
-    [
-        'project id',
-        matchesFilePart('projectId'),
-        'The transfer project id "{}" does not match the project id in the filename',
-    ],
-    [
-        'subrecipient id',
-        isValidSubrecipient,
-        'Each transfer row must have a "subrecipient id" which is included in the "subrecipient" tab',
-    ],
-    ['transfer number', isNotBlank, 'Transfer number cannot be blank'],
-    [
-
-        'award amount',
-        whenNotBlank('total expenditure amount', isAtLeast50K),
-        'Award amount must be at least $50,000',
-        { tags: ['v2'] },
-    ],
-    [
-        'transfer type',
-        dropdownIncludes('award payment method'),
-        'Transfer type "{}" is not valid',
-    ],
-
-    ['transfer date', isValidDate, 'Transfer date is not a valid date'],
-    [
-        'transfer date',
-        dateIsInReportingPeriod,
-        'Transfer date "{}" is not in reporting period',
-        { isDateValue: true },
-    ],
-
-    [
-        'current quarter obligation',
-        isNumberOrBlank,
-        'Current quarter obligation must be an amount',
-    ],
-    [
-
-        'current quarter obligation',
-        whenNotBlank('current quarter obligation', numberIsLessThanOrEqual('award amount')),
-        'Transfer {{transfer number}} current quarter obligation {{current quarter obligation}} must be less than or equal to the award amount',
-    ],
-    [
-        'award amount',
-        isEqual('current quarter obligation'),
-        'Award amount must equal obligation amount',
-        { tags: ['v2'] },
-    ],
-    [
-        'award amount',
-        cumulativeAmountIsEqual('current quarter obligation', transferMatches),
-        'Award amount must equal cumulative obligation amount',
-        { tags: ['cumulative'] },
-    ],
-    [
-        'award amount',
-        cumulativeAmountIsLessThanOrEqual('total expenditure amount', transferMatches),
-        'Cumulative expenditure amount must be less than or equal to award amount',
-        { tags: ['cumulative'] },
-    ],
-
-    [
-        'expenditure start date',
-        whenGreaterThanZero('total expenditure amount', isValidDate),
-        'Expenditure start date "{}" is not a valid date',
-        { isDateValue: true },
-    ],
-    [
-        'expenditure start date',
-        whenGreaterThanZero('total expenditure amount', isValidDate),
-        'Expenditure end date "{}" is not a valid date',
-        { isDateValue: true },
-    ],
-    [
-        'expenditure start date',
-        whenGreaterThanZero(
-            'total expenditure amount',
-            dateIsOnOrBefore('transfer date'),
-        ),
-        'Expenditure start date "{}" must be on or before transfer date',
-        { isDateValue: true },
-    ],
-    [
-        'expenditure start date',
-        whenGreaterThanZero(
-            'total expenditure amount',
-            dateIsOnOrBefore('expenditure end date'),
-        ),
-        'Expenditure start date "{}" must be on or before expenditure end date',
-        { isDateValue: true },
-    ],
-    [
-        'expenditure start date',
-        whenGreaterThanZero('total expenditure amount', dateIsInReportingPeriod),
-        'Expenditure start date "{}" must be in reporting period',
-        { isDateValue: true },
-    ],
-
-    [
-        'total expenditure amount',
-        isNumberOrBlank,
-        'Total expenditure amount must an amount',
-    ],
-    [
-        'total expenditure amount',
-        isSum(expenditureCategories),
-        'Total expenditure amount is not the sum of all expenditure amount columns',
-    ],
-    [
-        'other expenditure categories',
-        whenNotBlank('other expenditure amount', isNotBlank),
-        'Other Expenditure Categories cannot be blank if Other Expenditure Amount has an amount',
-    ],
-    [
-        'other expenditure amount',
-        whenNotBlank('other expenditure categories', isNumber),
-        'Other Expenditure Amount must be a number',
-    ],
-];
-
-module.exports = validateRecords('transfers', requiredFields);
-
-// NOTE: This file was copied from src/server/services/validate-data/transfers.js (git @ ada8bfdc98) in the arpa-reporter repo on 2022-09-23T20:05:47.735Z
diff --git a/packages/server/src/arpa_reporter/services/validate-data/validate.js b/packages/server/src/arpa_reporter/services/validate-data/validate.js
deleted file mode 100644
index 20c5b03b9..000000000
--- a/packages/server/src/arpa_reporter/services/validate-data/validate.js
+++ /dev/null
@@ -1,392 +0,0 @@
-const ssf = require('ssf');
-const mustache = require('mustache');
-const _ = require('lodash');
-const { ValidationItem } = require('../../lib/validation-log');
-const { log } = require('../../lib/log');
-const { subrecipientKey } = require('./helpers');
-
-function dateIsInPeriodOfPerformance(val, content, { reportingPeriod }) {
-    const dt = ssf.format('yyyy-MM-dd', val);
-    return dt >= '2020-03-01' && dt <= reportingPeriod.periodOfPerformanceEndDate;
-}
-
-function dateIsInReportingPeriod(val, content, { firstReportingPeriodStartDate, reportingPeriod }) {
-    const dt = ssf.format('yyyy-MM-dd', val);
-    return dt >= firstReportingPeriodStartDate && dt <= reportingPeriod.endDate;
-}
-
-function dateIsOnOrBefore(key) {
-    return (val, content) => new Date(val).getTime() <= new Date(content[key]).getTime();
-}
-
-function dateIsOnOrBeforeCRFEndDate(val, content, { reportingPeriod }) {
-    const dt = ssf.format('yyyy-MM-dd', val);
-    return dt <= reportingPeriod.crfEndDate;
-}
-
-function dateIsOnOrAfter(key) {
-    return (val, content) => new Date(val).getTime() >= new Date(content[key]).getTime();
-}
-
-function hasSubrecipientKey(val, content) {
-    return !!subrecipientKey(content);
-}
-
-function isNotBlank(val) {
-    return _.isNumber(val) || !_.isEmpty(val);
-}
-
-function isNumber(val) {
-    return _.isNumber(val);
-}
-
-function isNumberOrBlank(val) {
-    return _.isEmpty(val) || _.isNumber(val);
-}
-
-function isPositiveNumber(val) {
-    return _.isNumber(val) && val > 0;
-}
-
-function isPositiveNumberOrZero(val) {
-    return _.isNumber(val) ? val >= 0 : _.isEmpty(val);
-}
-
-function isAtLeast50K(val) {
-    return _.isNumber(val) && val >= 50000;
-}
-
-function isEqual(column) {
-    return (val, content) => {
-        const f1 = parseFloat(val) || 0.0;
-        const f2 = parseFloat(content[column]) || 0.0;
-        return Math.abs(f1 - f2) < 0.01;
-    };
-}
-
-function isSum(columns) {
-    return (val, content) => {
-        let sum = _.reduce(
-            columns,
-            (acc, c) => {
-                if (!c) {
-                    return acc;
-                }
-                const f = parseFloat(content[c]) || 0.0;
-                return acc + f;
-            },
-            0.0,
-        );
-        val = Number(val) || 0; // can come in as a string
-        val = _.round(val, 2);
-        sum = _.round(sum, 2); // parseFloat returns junk in the 11th decimal place
-        if (val !== sum) {
-            // console.log(`val is ${val}, sum is ${sum}`);
-        }
-        return val === sum;
-    };
-}
-
-function periodSummaryKey(key) {
-    switch (key) {
-        case 'current quarter obligation':
-            return 'current_obligation';
-        case 'total expenditure amount':
-            return 'current_expenditure';
-        default:
-            return '';
-    }
-}
-
-function withoutLeadingZeroes(v) {
-    return `${v}`.replace(/^0+/, '');
-}
-
-function summaryMatches(type, id, content) {
-    return (s) => {
-        const isMatch = s.award_type === type
-      && withoutLeadingZeroes(s.project_code) === withoutLeadingZeroes(content['project id'])
-      && `${content[id]}` === s.award_number;
-        // console.log('summary:', s);
-        // console.log('content:', content);
-        // console.log(s.award_type === type);
-        // console.log(withoutLeadingZeroes(s.project_code) === withoutLeadingZeroes(content['project id']));
-        // console.log(content[id] === s.award_number);
-        return isMatch;
-    };
-}
-
-function contractMatches(content) {
-    return summaryMatches('contracts', 'contract number', content);
-}
-
-function directMatches(content) {
-    return (s) => {
-        const awardNumber = `${content['subrecipient id']}:${content['obligation date']}`;
-        const isMatch = s.award_type === 'direct'
-      && withoutLeadingZeroes(s.project_code) === withoutLeadingZeroes(content['project id'])
-      && awardNumber === s.award_number;
-        return isMatch;
-    };
-}
-
-function grantMatches(content) {
-    return summaryMatches('grants', 'award number', content);
-}
-
-function loanMatches(content) {
-    return summaryMatches('loans', 'loan number', content);
-}
-
-function transferMatches(content) {
-    return summaryMatches('transfers', 'transfer number', content);
-}
-
-function cumulativeAmount(key, content, periodSummaries, filterPredicate) {
-    const summaries = _.get(periodSummaries, 'periodSummaries');
-    return _.chain(summaries)
-        .filter(filterPredicate(content))
-        .map(periodSummaryKey(key))
-        .reduce((acc, s) => acc + Number(s) || 0.0, 0.0)
-        .value();
-}
-
-function cumulativeAmountIsEqual(key, filterPredicate) {
-    return (val, content, { periodSummaries }) => {
-        const currentPeriodAmount = Number(content[key]) || 0.0;
-        const previousPeriodsAmount = cumulativeAmount(key, content, periodSummaries, filterPredicate);
-        const b = _.round(val, 2) === _.round(currentPeriodAmount + previousPeriodsAmount, 2);
-        if (!b) {
-            log('validate.js/cumulativeAmountIsEqual():',
-                key,
-                val,
-                'current:', currentPeriodAmount,
-                'previous:', previousPeriodsAmount,
-                'total:', currentPeriodAmount + previousPeriodsAmount);
-            log('content:');
-            log(JSON.stringify(content));
-        }
-        return b;
-    };
-}
-
-function cumulativeAmountIsLessThanOrEqual(key, filterPredicate) {
-    return (val, content, { periodSummaries }) => {
-        const currentPeriodAmount = Number(content[key]) || 0.0;
-        const previousPeriodsAmount = cumulativeAmount(key, content, periodSummaries, filterPredicate);
-        const b = _.round(currentPeriodAmount + previousPeriodsAmount, 2) <= _.round(val, 2);
-        if (!b) {
-            console.log('cumulativeAmountIsLessThanOrEqual:',
-                key,
-                val,
-                'current:', currentPeriodAmount,
-                'previous:', previousPeriodsAmount,
-                'total:', currentPeriodAmount + previousPeriodsAmount);
-            console.log('content:', JSON.stringify(content));
-        }
-        return b;
-    };
-}
-
-function isValidDate(val) {
-    return !_.isNaN(new Date(val).getTime());
-}
-
-function isValidSubrecipient(val, content, { subrecipientsHash }) {
-    return _.has(subrecipientsHash, val);
-}
-
-function isUnitedStates(value) {
-    return value === 'usa' || value === 'united states';
-}
-
-// TODO: re-write this
-// eslint-disable-next-line no-unused-vars
-function dropdownIncludes(key) {
-    // eslint-disable-next-line no-unused-vars
-    return (val) => true;
-}
-
-function isValidState(val) {
-    log(`isValidState(${val})`);
-    return (
-        dropdownIncludes('state code')(val)
-    );
-}
-
-function isValidZip(val) {
-    return /^\d{5}(-\d{4})?$/.test(`${val}`);
-}
-
-function matchesFilePart(key) {
-    return function (val, content, { fileParts }) {
-        const fileValue = fileParts[key].replace(/^0*/, '');
-        const documentValue = (val || '').toString().replace(/^0*/, '');
-        return documentValue === fileValue;
-    };
-}
-
-function numberIsLessThanOrEqual(key) {
-    return (val, content) => {
-        const other = _.isNumber(content[key]) ? content[key] : 0.00;
-        const b = _.isNumber(val) && _.isNumber(other) && val <= other;
-        if (!b) {
-            console.log('numberIsLessThanOrEqual fails:', key, val, _.isNumber(val), other, _.isNumber(other), val <= other);
-        }
-        return b;
-    };
-}
-
-function numberIsGreaterThanOrEqual(key) {
-    return (val, content) => {
-        const other = _.isNumber(content[key]) ? content[key] : 0.00;
-        return _.isNumber(val) && _.isNumber(other) && val >= other;
-    };
-}
-
-function whenBlank(key, validator) {
-    return (val, content, context) => !!content[key] || validator(val, content, context);
-}
-
-function whenNotBlank(key, validator) {
-    return (val, content, context) => !content[key] || validator(val, content, context);
-}
-
-function whenUS(key, validator) {
-    return (val, content, context) => !isUnitedStates(content[key])
-      || validator(val, content, context);
-}
-
-function whenGreaterThanZero(key, validator) {
-    return (val, content, context) => (content[key] > 0 ? validator(val, content, context) : true);
-}
-
-function addValueToMessage(message, value, content) {
-    const s = message.replace('{}', `${value || ''}`);
-    return mustache.render(s, content);
-}
-
-function messageValue(val, options) {
-    if (options && options.isDateValue && val) {
-        const dt = new Date(val).getTime();
-        return _.isNaN(dt) ? val : ssf.format('MM/dd/yyyy', val);
-    }
-    return val;
-}
-
-function includeValidator(options, context) {
-    const tags = _.get(options, 'tags');
-    if (!tags) {
-        return true;
-    }
-    if (!context.tags) {
-        return false;
-    }
-    return !_.isEmpty(_.intersection(tags, context.tags));
-}
-
-function validateFields(requiredFields, content, tab, row, context = {}) {
-    // console.log("------ required fields are:");
-    // console.dir(requiredFields);
-    // console.log("------content is");
-    // console.dir(content);
-    // console.log("------content end");
-    const valog = [];
-    requiredFields.forEach(([key, validator, message, options]) => {
-        if (includeValidator(options, context)) {
-            const val = content[key] || '';
-            if (!validator(val, content, context)) {
-                // console.log(`val ${val}, content:`);
-                // console.dir(content);
-                // console.log(`val ${val}, context:`);
-                // console.dir(context);
-                const finalMessage = addValueToMessage(
-                    message || `Empty or invalid entry for ${key}: "{}"`,
-                    messageValue(val, options),
-                    content,
-                );
-                console.log(finalMessage);
-                valog.push(
-                    new ValidationItem({
-                        message: finalMessage,
-                        tab,
-                        row,
-                    }),
-                );
-            }
-        }
-    });
-    return valog;
-}
-
-function validateRecords(tab, validations) {
-    return function (groupedRecords, validateContext) {
-        const records = groupedRecords[tab];
-        return _.flatMap(records, ({ content, sourceRow }) => validateFields(
-            validations,
-            content,
-            tab,
-            sourceRow,
-            validateContext,
-        ));
-    };
-}
-
-function validateSingleRecord(tab, validations, message) {
-    return function (groupedRecords, validateContext) {
-        const records = groupedRecords[tab];
-        let valog = [];
-
-        if (records && records.length === 1) {
-            const { content } = records[0];
-            const row = 2;
-            const results = validateFields(validations, content, tab, row, validateContext);
-            valog = valog.concat(results);
-        } else {
-            valog.push(new ValidationItem({ message, tab }));
-        }
-        return valog;
-    };
-}
-
-module.exports = {
-    contractMatches,
-    cumulativeAmountIsEqual,
-    cumulativeAmountIsLessThanOrEqual,
-    dateIsInPeriodOfPerformance,
-    dateIsInReportingPeriod,
-    dateIsOnOrBefore,
-    dateIsOnOrBeforeCRFEndDate,
-    dateIsOnOrAfter,
-    directMatches,
-    grantMatches,
-    dropdownIncludes,
-    hasSubrecipientKey,
-    isEqual,
-    isAtLeast50K,
-    isNotBlank,
-    isNumber,
-    isNumberOrBlank,
-    isPositiveNumber,
-    isPositiveNumberOrZero,
-    isSum,
-    isValidDate,
-    isValidState,
-    isValidSubrecipient,
-    isValidZip,
-    loanMatches,
-    matchesFilePart,
-    messageValue,
-    numberIsLessThanOrEqual,
-    numberIsGreaterThanOrEqual,
-    transferMatches,
-    validateRecords,
-    validateFields,
-    validateSingleRecord,
-    whenBlank,
-    whenGreaterThanZero,
-    whenNotBlank,
-    whenUS,
-};
-
-// NOTE: This file was copied from src/server/services/validate-data/validate.js (git @ ada8bfdc98) in the arpa-reporter repo on 2022-09-23T20:05:47.735Z
diff --git a/packages/server/src/db/index.js b/packages/server/src/db/index.js
index 9f72850d4..c47a3948e 100755
--- a/packages/server/src/db/index.js
+++ b/packages/server/src/db/index.js
@@ -125,13 +125,40 @@ async function getUsersEmailAndName(ids) {
 }
 
 async function getUser(id) {
-    const [user] = await knex('users')
+    // Temporary check for avatar_column until migration is applied in prod. Clean up ticket: #2259
+    const avatarColorExists = await knex.schema.hasColumn('users', 'avatar_color');
+
+    const [user] = avatarColorExists ? await knex('users')
+        .select(
+            'users.id',
+            'users.email',
+            'users.name',
+            'users.role_id',
+            'users.avatar_color', // adds column
+            'roles.name as role_name',
+            'roles.rules as role_rules',
+            'users.agency_id',
+            'agencies.name as agency_name',
+            'agencies.abbreviation as agency_abbreviation',
+            'agencies.parent as agency_parent_id_id',
+            'agencies.warning_threshold as agency_warning_threshold',
+            'agencies.danger_threshold as agency_danger_threshold',
+            'tenants.id as tenant_id',
+            'tenants.display_name as tenant_display_name',
+            'tenants.main_agency_id as tenant_main_agency_id',
+            'tenants.uses_spoc_process as tenant_uses_spoc_process',
+            'users.tags',
+            'users.tenant_id',
+        )
+        .leftJoin('roles', 'roles.id', 'users.role_id')
+        .leftJoin('agencies', 'agencies.id', 'users.agency_id')
+        .leftJoin('tenants', 'tenants.id', 'users.tenant_id')
+        .where('users.id', id) : await knex('users')
         .select(
             'users.id',
             'users.email',
             'users.name',
             'users.role_id',
-            'users.avatar_color',
             'roles.name as role_name',
             'roles.rules as role_rules',
             'users.agency_id',
diff --git a/packages/server/src/lib/email.js b/packages/server/src/lib/email.js
index ec9a070ea..bf1a25190 100644
--- a/packages/server/src/lib/email.js
+++ b/packages/server/src/lib/email.js
@@ -117,10 +117,13 @@ function sendWelcomeEmail(email, httpOrigin) {
 
 function getGrantDetail(grant, emailNotificationType) {
     const grantDetailTemplate = fileSystem.readFileSync(path.join(__dirname, '../static/email_templates/_grant_detail.html'));
+
+    const description = grant.description.substring(0, 380).replace(/(<([^>]+)>)/ig, '');
+
     const grantDetail = mustache.render(
         grantDetailTemplate.toString(), {
             title: grant.title,
-            description: grant.description && grant.description.length > 400 ? `${grant.description.substring(0, 400)}...` : grant.description,
+            description,
             status: grant.opportunity_status,
             show_date_range: grant.open_date && grant.close_date,
             open_date: grant.open_date ? new Date(grant.open_date).toLocaleDateString('en-US', { timeZone: 'UTC' }) : undefined,
@@ -193,7 +196,7 @@ async function sendGrantAssignedEmail({ grantId, agencyIds, userId }) {
     agencies.forEach((agency) => module.exports.sendGrantAssignedNotficationForAgency(agency, grantDetail, userId));
 }
 
-async function buildDigestBody(matchedGrants) {
+async function buildDigestBody({ name, openDate, matchedGrants }) {
     const grantDetails = [];
     matchedGrants.slice(0, 30).forEach((grant) => grantDetails.push(module.exports.getGrantDetail(grant, notificationType.grantDigest)));
 
@@ -201,14 +204,14 @@ async function buildDigestBody(matchedGrants) {
     const contentSpacerTemplate = fileSystem.readFileSync(path.join(__dirname, '../static/email_templates/_content_spacer.html'));
     const contentSpacerStr = contentSpacerTemplate.toString();
 
-    let additionalBody = grantDetails.join(contentSpacerStr);
+    let additionalBody = grantDetails.join(contentSpacerStr).concat(contentSpacerStr);
 
     const additionalButtonTemplate = fileSystem.readFileSync(path.join(__dirname, '../static/email_templates/_additional_grants_button.html'));
     additionalBody += mustache.render(additionalButtonTemplate.toString(), { additional_grants_url: `${process.env.WEBSITE_DOMAIN}/#/grants` });
 
     const formattedBody = mustache.render(formattedBodyTemplate.toString(), {
-        body_title: 'New grants have been posted',
-        body_detail: `There are ${matchedGrants.length} new grants matching your keywords and settings.`,
+        body_title: `${name} - ${matchedGrants.length} NEW GRANTS`,
+        body_detail: moment(openDate).format('MMMM Do YYYY'),
         additional_body: additionalBody,
     });
 
@@ -230,10 +233,10 @@ async function sendGrantDigest({
         return;
     }
 
-    const formattedBody = await buildDigestBody(matchedGrants);
+    const formattedBody = await buildDigestBody({ name, openDate, matchedGrants });
 
     const emailHTML = module.exports.addBaseBranding(formattedBody, {
-        tool_name: 'Grants Identification Tool',
+        tool_name: 'Federal Grant Finder',
         title: 'New Grants Digest',
         notifications_url: `${process.env.WEBSITE_DOMAIN}/#/grants?manageSettings=true`,
     });
diff --git a/packages/server/src/routes/grants.js b/packages/server/src/routes/grants.js
index d96409bc9..8d4a298a6 100755
--- a/packages/server/src/routes/grants.js
+++ b/packages/server/src/routes/grants.js
@@ -156,7 +156,7 @@ router.get('/exportCSVNew', requireUser, async (req, res) => {
             { key: 'grant_number', header: 'Opportunity Number' },
             { key: 'title', header: 'Title' },
             { key: 'viewed_by', header: 'Viewed By' },
-            { key: 'interested_agencies', header: 'Interested Teams' },
+            { key: 'interested_agencies', header: process.env.ENABLE_NEW_TEAM_TERMINOLOGY === 'true' ? 'Interested Teams' : 'Interested Agencies' },
             { key: 'opportunity_status', header: 'Opportunity Status' },
             { key: 'opportunity_category', header: 'Opportunity Category' },
             { key: 'cost_sharing', header: 'Cost Sharing' },
@@ -240,7 +240,7 @@ router.get('/exportCSV', requireUser, async (req, res) => {
             { key: 'grant_number', header: 'Opportunity Number' },
             { key: 'title', header: 'Title' },
             { key: 'viewed_by', header: 'Viewed By' },
-            { key: 'interested_agencies', header: 'Interested Teams' },
+            { key: 'interested_agencies', header: process.env.ENABLE_NEW_TEAM_TERMINOLOGY === 'true' ? 'Interested Teams' : 'Interested Agencies' },
             { key: 'opportunity_status', header: 'Status' },
             { key: 'opportunity_category', header: 'Opportunity Category' },
             { key: 'cost_sharing', header: 'Cost Sharing' },
diff --git a/packages/server/src/static/email_templates/_additional_grants_button.html b/packages/server/src/static/email_templates/_additional_grants_button.html
index 40333acc4..4b6f1209f 100644
--- a/packages/server/src/static/email_templates/_additional_grants_button.html
+++ b/packages/server/src/static/email_templates/_additional_grants_button.html
@@ -1,13 +1,13 @@
 <table class="es-content" cellspacing="0" cellpadding="0" align="center"
 style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px;table-layout:fixed !important;width:100%">
 <tr style="border-collapse:collapse">
-    <td align="center" bgcolor="#FFFFFF" style="padding:0;Margin:0;background-color:#ffffff">
+    <td align="center" bgcolor="#FFFFFF" style="padding:0;Margin:0;background-color:#f6f6f6">
         <table class="es-content-body"
-            style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px;background-color:#ffffff;width:640px"
+            style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px;background-color:#f6f6f6;width:640px"
             cellspacing="0" cellpadding="0" bgcolor="#FFFFFF" align="center">
             <tr style="border-collapse:collapse">
                 <td align="left"
-                    style="padding:0;Margin:0;padding-top:10px;padding-left:20px;padding-right:20px">
+                    style="padding:0;Margin:0;padding-top:28px;padding-bottom:28px;padding-left:20px;padding-right:20px">
                     <table width="100%" cellspacing="0" cellpadding="0"
                         style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px">
                         <tr style="border-collapse:collapse">
@@ -17,22 +17,25 @@
                                     role="presentation"
                                     style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px">
                                     <tr style="border-collapse:collapse">
-                                        <td align="center" style="padding:0;Margin:0">
-                                            <!--[if mso]><a href="{{additional_grants_url}}" target="_blank" hidden>
-<v:roundrect xmlns:v="urn:schemas-microsoft-com:vml" xmlns:w="urn:schemas-microsoft-com:office:word" esdevVmlButton href="{{additional_grants_url}}"
-style="height:49px; v-text-anchor:middle; width:187px" arcsize="0%" strokecolor="#75b6c9" strokeweight="1px" fillcolor="#007bff">
-<w:anchorlock></w:anchorlock>
-<center style='color:#ffffff; font-family:"open sans", "helvetica neue", helvetica, arial, sans-serif; font-size:16px; font-weight:400; line-height:16px; mso-text-raise:1px'>See all new grants</center>
-</v:roundrect></a>
-<![endif]-->
-                                            <!--[if !mso]><!-- --><span
-                                                class="msohide es-button-border"
-                                                style="border-style:solid;border-color:#75B6C9;background:#007bff;border-width:1px;display:inline-block;border-radius:0px;width:auto;mso-hide:all"><a
-                                                    href="{{additional_grants_url}}" class="es-button" target="_blank"
-                                                    style="mso-style-priority:100 !important;text-decoration:none;-webkit-text-size-adjust:none;-ms-text-size-adjust:none;mso-line-height-rule:exactly;color:#FFFFFF;font-size:16px;border-style:solid;border-color:#007bff;border-width:15px 25px 15px 25px;display:inline-block;background:#007bff;border-radius:0px;font-family:'open sans', 'helvetica neue', helvetica, arial, sans-serif;font-weight:normal;font-style:normal;line-height:19px;width:auto;text-align:center">See
-                                                    all new grants</a></span>
-                                            <!--<![endif]-->
-                                        </td>
+                                              <td align="center" style="padding:0;Margin:0">
+                                                <div>
+                                                  <!--[if mso]>
+                                                    <v:roundrect xmlns_v="urn:schemas-microsoft-com:vml" xmlns_w="urn:schemas-microsoft-com:office:word" href="{{additional_grants_url}}" style="height:40px;v-text-anchor:middle;width:185px;" arcsize="5%" strokecolor="#007bff" fillcolor="#007bff;width: 185;">
+                                                      <w:anchorlock/>
+                                                        <v:textbox inset="0,0,0,0">
+                                                          <center>
+
+                                          
+                                                  <![endif]-->
+                                                    <a href="{{additional_grants_url}}" target="_blank" style="background-color:#007bff;display:inline-block;text-decoration:none;-webkit-text-size-adjust:none;-ms-text-size-adjust:none;color:#FFFFFF;border-radius:8px;font-size:16px;font-family:'open sans','helvetica neue',helvetica,arial,sans-serif;font-weight:500;font-style:normal;line-height:40px;width:185px;text-align:center">See all new grants</a>
+                                                    </a>
+                                                  <!--[if mso]>
+                                                    </center>
+                                                      </v:textbox>
+                                                      </v:roundrect>
+                                                  <![endif]-->
+                                                  </div>
+                                              </td>
                                     </tr>
                                 </table>
                             </td>
diff --git a/packages/server/src/static/email_templates/_content_spacer.html b/packages/server/src/static/email_templates/_content_spacer.html
index 31a297a6d..404d54d57 100644
--- a/packages/server/src/static/email_templates/_content_spacer.html
+++ b/packages/server/src/static/email_templates/_content_spacer.html
@@ -1,11 +1,11 @@
 <table class="es-content" cellspacing="0" cellpadding="0" align="center"
 style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px;table-layout:fixed !important;width:100%">
 <tr style="border-collapse:collapse">
-    <td align="center" bgcolor="#FFFFFF" style="padding:0;Margin:0;background-color:#ffffff">
+    <td align="center" bgcolor="#f6f6f6" style="padding:0;Margin:0;background-color:#f6f6f6">
         <table class="es-content-body"
-            style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px;background-color:#ffffff;width:640px"
-            cellspacing="0" cellpadding="0" bgcolor="#FFFFFF" align="center">
-            <tr style="border-collapse:collapse">
+            style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px;background-color:#f6f6f6;width:640px"
+            cellspacing="0" cellpadding="0" bgcolor="#f6f6f6" align="center">
+            <tr style="border-collapse:collapse;background-color:#ffffff">
                 <td align="left"
                     style="padding:0;Margin:0;padding-top:10px;padding-left:20px;padding-right:20px">
                     <table width="100%" cellspacing="0" cellpadding="0"
@@ -24,7 +24,7 @@
                                                 style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px">
                                                 <tr style="border-collapse:collapse">
                                                     <td
-                                                        style="padding:0;Margin:0;border-bottom:1px solid #f6f6f6;background:#FFFFFF none repeat scroll 0% 0%;height:1px;width:100%;margin:0px">
+                                                        style="padding:0;Margin:0;background:#FFFFFF none repeat scroll 0% 0%;height:1px;width:100%;margin:0px">
                                                     </td>
                                                 </tr>
                                             </table>
diff --git a/packages/server/src/static/email_templates/_formatted_body.html b/packages/server/src/static/email_templates/_formatted_body.html
index d3b5246d1..bb171ab4f 100644
--- a/packages/server/src/static/email_templates/_formatted_body.html
+++ b/packages/server/src/static/email_templates/_formatted_body.html
@@ -1,12 +1,12 @@
 <table class="es-content" cellspacing="0" cellpadding="0" align="center"
     style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px;table-layout:fixed !important;width:100%">
     <tr style="border-collapse:collapse">
-        <td align="center" bgcolor="#FFFFFF" style="padding:0;Margin:0;background-color:#ffffff">
+        <td align="center" bgcolor="#f6f6f6" style="padding:0;Margin:0;background-color:#f6f6f6">
             <table class="es-content-body"
                 style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px;background-color:#f6f6f6;width:640px"
                 cellspacing="0" cellpadding="0" bgcolor="#f6f6f6" align="center">
                 <tr style="border-collapse:collapse">
-                    <td align="left" bgcolor="#FFFFFF" style="padding:20px;Margin:0;background-color:#ffffff">
+                    <td align="left" bgcolor="#FFFFFF" style="Margin:0;background-color:#ffffff;padding-top:36px;padding-right:20px;padding-bottom:36px;padding-left:20px;">
                         <table width="100%" cellspacing="0" cellpadding="0"
                             style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px">
                             <tr style="border-collapse:collapse">
@@ -15,19 +15,19 @@
                                         style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px">
                                         {{#body_title}}
                                         <tr style="border-collapse:collapse">
-                                            <td align="left" style="padding:0;Margin:0">
+                                            <td align="left" style="padding:0;padding-bottom:3px;Margin:0">
                                                 <p
-                                                    style="Margin:0;-webkit-text-size-adjust:none;-ms-text-size-adjust:none;mso-line-height-rule:exactly;font-family:arial, 'helvetica neue', helvetica, sans-serif;line-height:39px;color:#000000;font-size:26px">
-                                                    <strong>{{body_title}}</strong>
+                                                    style="Margin:0;-webkit-text-size-adjust:none;-ms-text-size-adjust:none;mso-line-height-rule:exactly;font-family:arial, 'helvetica neue', helvetica, sans-serif;line-height:normal;letter-spacing: 1px; text-transform: uppercase; color:#000000;font-size:14px">
+                                                    {{body_title}}
                                                 </p>
                                             </td>
                                         </tr>
                                         {{/body_title}}
                                         {{#body_detail}}
                                         <tr style="border-collapse:collapse">
-                                            <td align="left" style="padding:0;Margin:0">
+                                            <td align="left" style="padding:0;padding-top:3px;Margin:0">
                                                 <p
-                                                    style="Margin:0;-webkit-text-size-adjust:none;-ms-text-size-adjust:none;mso-line-height-rule:exactly;font-family:arial, 'helvetica neue', helvetica, sans-serif;line-height:24px;color:#000000;font-size:16px">
+                                                    style="Margin:0;-webkit-text-size-adjust:none;-ms-text-size-adjust:none;mso-line-height-rule:exactly;font-family:arial, 'helvetica neue', helvetica, sans-serif;line-height:normal;letter-spacing: 1px;color:#43464A;font-size:14px">
                                                     {{{body_detail}}}
                                                 </p>
                                             </td>
diff --git a/packages/server/src/static/email_templates/_grant_detail.html b/packages/server/src/static/email_templates/_grant_detail.html
index 31ad24e34..ede16230e 100644
--- a/packages/server/src/static/email_templates/_grant_detail.html
+++ b/packages/server/src/static/email_templates/_grant_detail.html
@@ -1,7 +1,7 @@
 <table class="es-content" cellspacing="0" cellpadding="0" align="center"
     style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px;table-layout:fixed !important;width:100%">
     <tr style="border-collapse:collapse">
-        <td align="center" bgcolor="#FFFFFF" style="padding:0;Margin:0;background-color:#ffffff">
+        <td align="center" bgcolor="#f6f6f6" style="padding:0;Margin:0;background-color:#f6f6f6">
             <table class="es-content-body"
                 style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px;background-color:transparent;width:640px"
                 cellspacing="0" cellpadding="0" align="center">
@@ -13,57 +13,45 @@
                             <tr style="border-collapse:collapse">
                                 <td valign="top" align="center" style="padding:0;Margin:0;width:600px">
                                     <table
-                                        style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:separate;border-spacing:0px;border-radius:3px;background-color:#f2f2f2"
-                                        width="100%" cellspacing="0" cellpadding="0" bgcolor="#F2F2F2"
+                                        style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:separate;border-spacing:0px;border-radius:3px;"
+                                        width="100%" cellspacing="0" cellpadding="0"
                                         role="presentation">
                                         <tr style="border-collapse:collapse">
-                                            <td align="center"
-                                                style="Margin:0;padding-bottom:5px;padding-left:20px;padding-right:20px;padding-top:25px">
-                                                <h2
-                                                    style="Margin:0;line-height:24px;mso-line-height-rule:exactly;font-family:arial, 'helvetica neue', helvetica, sans-serif;font-size:20px;font-style:normal;font-weight:bold;color:#444444">
+                                            <td align="left"
+                                                style="Margin:0;padding-bottom:16px;">
+                                                <a style="text-decoration:none;" href="{{link_url}}">
+                                                    <h2
+                                                    style="Margin:0;line-height:30px;mso-line-height-rule:exactly;font-family:arial,'helvetica neue',helvetica,sans-serif;font-size:22px;font-style:normal;font-weight:normal;color:#0068D6">
                                                     {{title}}</h2>
+                                                </a>
                                             </td>
                                         </tr>
                                         <tr style="border-collapse:collapse">
-                                            <td align="center"
-                                                style="Margin:0;padding-top:10px;padding-bottom:15px;padding-left:20px;padding-right:20px">
+                                            <td align="left"
+                                                style="Margin:0;padding-bottom:16px;">
                                                 <p
                                                     style="Margin:0;-webkit-text-size-adjust:none;-ms-text-size-adjust:none;mso-line-height-rule:exactly;font-family:arial, 'helvetica neue', helvetica, sans-serif;line-height:24px;color:#000000;font-size:16px">
-                                                    <span class="product-description">{{{description}}}</span>
+                                                    {{{description}}}<span>... View on <a style="color:#0068D6;text-decoration:none;" href="{{link_url}}">Grants.gov</a></span>
                                                 </p>
                                             </td>
                                         </tr>
-                                        <tr style="border-collapse:collapse">
-                                            <td align="center" style="padding:20px;Margin:0;font-size:0">
-                                                <table border="0" width="100%" height="100%" cellpadding="0"
-                                                    cellspacing="0" role="presentation"
-                                                    style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px">
-                                                    <tr style="border-collapse:collapse">
-                                                        <td
-                                                            style="padding:0;Margin:0;border-bottom:1px solid #cccccc;background:unset;height:1px;width:100%;margin:0px">
-                                                        </td>
-                                                    </tr>
-                                                </table>
-                                            </td>
-                                        </tr>
                                         <tr style="border-collapse:collapse">
                                             <td align="left"
-                                                style="Margin:0;padding-top:10px;padding-bottom:15px;padding-left:20px;padding-right:20px">
+                                                style="Margin:0">
                                                 <p
                                                     style="Margin:0;-webkit-text-size-adjust:none;-ms-text-size-adjust:none;mso-line-height-rule:exactly;font-family:arial, 'helvetica neue', helvetica, sans-serif;line-height:24px;color:#000000;font-size:16px">
                                                     <span class="product-description">
-                                                        <strong>Status: </strong>{{status}}<br>
+                                                        <strong>Status: </strong><span style="text-transform:capitalize;"  >{{status}}</span><br>
                                                         {{#show_date_range}}
-                                                            <strong>Valid from: </strong>{{open_date}} - {{close_date}}<br>
+                                                            <strong>Valid From: </strong>{{open_date}} - {{close_date}}<br>
                                                         {{/show_date_range}}
-                                                        <strong>Award Range: </strong>{{award_floor}} – {{award_ceiling}}<br>
+                                                        <strong>Award Range: </strong>{{award_floor}} - {{award_ceiling}}<br>
                                                         {{#estimated_funding}}
-                                                            <strong>Estimated Total Program Funding:</strong>{{estimated_funding}}<br>
+                                                            <strong>Estimated Total Program Funding: </strong>{{estimated_funding}}<br>
                                                         {{/estimated_funding}}
                                                         {{#cost_sharing}}
-                                                            <strong>Cost Sharing:</strong>{{cost_sharing}}<br>
+                                                            <strong>Cost Sharing: </strong>{{cost_sharing}}<br>
                                                         {{/cost_sharing}}
-                                                        <strong><a href="{{link_url}}">View in Grants.gov</a></strong>
                                                     </span>
                                                 </p>
                                             </td>
diff --git a/packages/server/src/static/email_templates/base.html b/packages/server/src/static/email_templates/base.html
index 08e55a1c5..116d004a6 100644
--- a/packages/server/src/static/email_templates/base.html
+++ b/packages/server/src/static/email_templates/base.html
@@ -388,15 +388,15 @@
                     <table class="es-header" cellspacing="0" cellpadding="0" align="center"
                         style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px;table-layout:fixed !important;width:100%;background-color:transparent;background-repeat:repeat;background-position:center top">
                         <tr style="border-collapse:collapse">
-                            <td style="padding:0;Margin:0;background-size:cover;background-color:#ddeffc"
+                            <td style="padding:0;Margin:0;background-size:cover;background-color:transparent"
                                 bgcolor="#DDEFFC" align="center">
                                 <table class="es-header-body"
-                                    style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px;background-color:transparent;width:640px"
+                                    style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px;margin-top:50px;background-color:#ddeffc;"
                                     cellspacing="0" cellpadding="0" align="center">
                                     <tr style="border-collapse:collapse">
                                         <td align="left"
-                                            style="Margin:0;padding-top:10px;padding-left:20px;padding-right:20px;padding-bottom:25px">
-                                            <table width="100%" cellspacing="0" cellpadding="0"
+                                            style="Margin:0;padding-top:32px;padding-left:20px;padding-right:20px;padding-bottom:32px">
+                                            <table cellspacing="0" cellpadding="0"
                                                 style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px">
                                                 <tr style="border-collapse:collapse">
                                                     <td valign="top" align="center"
@@ -406,7 +406,7 @@
                                                             style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px">
                                                             <tr style="border-collapse:collapse">
                                                                 <td align="center"
-                                                                    style="padding:0;Margin:0;padding-top:40px;font-size:0px">
+                                                                    style="padding:0;Margin:0;font-size:0px">
                                                                     <a href="{{usdr_url}}" target="_blank"
                                                                         style="-webkit-text-size-adjust:none;-ms-text-size-adjust:none;mso-line-height-rule:exactly;text-decoration:none;color:#B7BDC9;font-size:20px"><img
                                                                             src="{{usdr_logo_url}}"
@@ -436,10 +436,10 @@
                     <table class="es-content" cellspacing="0" cellpadding="0" align="center"
                         style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px;table-layout:fixed !important;width:100%">
                         <tr style="border-collapse:collapse">
-                            <td align="center" bgcolor="#FFFFFF" style="padding:0;Margin:0;background-color:#ffffff">
+                            <td align="center" bgcolor="#F6F6F6" style="padding:0;Margin:0;background-color:#F6F6F6">
                                 <table class="es-content-body"
-                                    style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px;background-color:#ffffff;width:640px"
-                                    cellspacing="0" cellpadding="0" bgcolor="#FFFFFF" align="center">
+                                    style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px;background-color:#F6F6F6;width:640px"
+                                    cellspacing="0" cellpadding="0" bgcolor="#F6F6F6" align="center">
                                     <tr style="border-collapse:collapse">
                                         <td align="left"
                                             style="padding:0;Margin:0;padding-top:10px;padding-left:20px;padding-right:20px">
@@ -458,9 +458,6 @@
                                                                         cellpadding="0" border="0" role="presentation"
                                                                         style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px">
                                                                         <tr style="border-collapse:collapse">
-                                                                            <td
-                                                                                style="padding:0;Margin:0;border-bottom:1px solid #f6f6f6;background:#FFFFFF none repeat scroll 0% 0%;height:1px;width:100%;margin:0px">
-                                                                            </td>
                                                                         </tr>
                                                                     </table>
                                                                 </td>
@@ -476,11 +473,11 @@
                         </tr>
                     </table>
                     <table cellpadding="0" cellspacing="0" class="es-footer" align="center"
-                        style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px;table-layout:fixed !important;width:100%;background-color:transparent;background-repeat:repeat;background-position:center top">
+                        style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px;table-layout:fixed !important;width:100%;background-color:#F0F0F0;background-repeat:repeat;background-position:center top">
                         <tr style="border-collapse:collapse">
                             <td align="center" style="padding:0;Margin:0">
                                 <table class="es-footer-body" cellspacing="0" cellpadding="0" align="center"
-                                    style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px;background-color:#F6F6F6;width:640px">
+                                    style="mso-table-lspace:0pt;mso-table-rspace:0pt;border-collapse:collapse;border-spacing:0px;background-color:#F0F0F0;width:640px">
                                     <tr style="border-collapse:collapse">
                                         <td align="left"
                                             style="Margin:0;padding-left:20px;padding-right:20px;padding-top:40px;padding-bottom:40px">
@@ -496,9 +493,9 @@
                                                                 {{#notifications_url}}
                                                                 <td align="center" style="padding:0;Margin:0">
                                                                     <p
-                                                                        style="Margin:0;-webkit-text-size-adjust:none;-ms-text-size-adjust:none;mso-line-height-rule:exactly;font-family:'open sans', 'helvetica neue', helvetica, arial, sans-serif;line-height:21px;color:#999999;font-size:14px">
-                                                                        <u><a href="{{notifications_url}}">Change
-                                                                                Notification Preferences</a></u>
+                                                                        style="Margin:0;-webkit-text-size-adjust:none;-ms-text-size-adjust:none;mso-line-height-rule:exactly;font-family:'open sans', 'helvetica neue', helvetica, arial, sans-serif;line-height:21px;color:#999999;font-size:14px;">
+                                                                        <u style="text-decoration:none;" ><a style="color:#0068D6;text-decoration:none;" href="{{notifications_url}}">Change
+                                                                                notification preferences</a></u>
                                                                     </p>
                                                                 </td>
                                                                 {{/notifications_url}}
diff --git a/terraform/main.tf b/terraform/main.tf
index 32a722ab1..e829a0143 100644
--- a/terraform/main.tf
+++ b/terraform/main.tf
@@ -66,6 +66,9 @@ module "website" {
   gost_api_domain   = local.api_domain_name
   managed_waf_rules = var.website_managed_waf_rules
   feature_flags     = var.website_feature_flags
+  origin_artifacts_dist_path = coalesce(
+    var.website_origin_artifacts_dist_path, "${path.root}/../packages/client/dist"
+  )
 }
 
 module "api_to_postgres_security_group" {
@@ -160,6 +163,7 @@ module "api" {
   autoscaling_desired_count_maximum = var.api_maximum_task_count
   enable_grants_scraper             = var.api_enable_grants_scraper
   enable_grants_digest              = var.api_enable_grants_digest
+  enable_new_team_terminology       = var.api_enable_new_team_terminology
   enable_saved_search_grants_digest = var.api_enable_saved_search_grants_digest
   unified_service_tags              = local.unified_service_tags
   datadog_environment_variables     = var.api_datadog_environment_variables
diff --git a/terraform/modules/gost_api/storage.tf b/terraform/modules/gost_api/storage.tf
index 188cd64df..3450ae7cd 100644
--- a/terraform/modules/gost_api/storage.tf
+++ b/terraform/modules/gost_api/storage.tf
@@ -1,6 +1,6 @@
 module "efs_data_volume" {
   source  = "cloudposse/efs/aws"
-  version = "0.34.0"
+  version = "0.35.0"
   context = module.this.context
 
   name                       = "${var.namespace}-data_volume"
diff --git a/terraform/modules/gost_api/task.tf b/terraform/modules/gost_api/task.tf
index 95e52a451..2b7fe42d7 100644
--- a/terraform/modules/gost_api/task.tf
+++ b/terraform/modules/gost_api/task.tf
@@ -50,6 +50,7 @@ module "api_container_definition" {
       ENABLE_GRANTS_DIGEST              = var.enable_grants_digest ? "true" : "false"
       ENABLE_SAVED_SEARCH_GRANTS_DIGEST = var.enable_saved_search_grants_digest ? "true" : "false"
       ENABLE_GRANTS_SCRAPER             = "false"
+      ENABLE_NEW_TEAM_TERMINOLOGY       = var.enable_new_team_terminology ? "true" : "false"
       GRANTS_SCRAPER_DATE_RANGE         = 7
       GRANTS_SCRAPER_DELAY              = 1000
       NODE_OPTIONS                      = "--max_old_space_size=1024"
diff --git a/terraform/modules/gost_api/variables.tf b/terraform/modules/gost_api/variables.tf
index 235b62cf3..21bed14c3 100644
--- a/terraform/modules/gost_api/variables.tf
+++ b/terraform/modules/gost_api/variables.tf
@@ -168,6 +168,12 @@ variable "enable_grants_digest" {
   default     = false
 }
 
+variable "enable_new_team_terminology" {
+  description = "When true, sets the ENABLE_NEW_TEAM_TERMINOLOGY environment variable to true in the API container."
+  type        = bool
+  default     = false
+}
+
 variable "enable_saved_search_grants_digest" {
   description = "When true, sets the ENABLE_SAVED_SEARCH_GRANTS_DIGEST environment variable to true in the API container."
   type        = bool
diff --git a/terraform/modules/gost_website/storage.tf b/terraform/modules/gost_website/storage.tf
index e1aaa7fad..657711449 100644
--- a/terraform/modules/gost_website/storage.tf
+++ b/terraform/modules/gost_website/storage.tf
@@ -111,6 +111,55 @@ module "origin_bucket" {
   ]
 }
 
+locals {
+  origin_artifacts_dist_path       = trimsuffix(var.origin_artifacts_dist_path, "/")
+  origin_artifacts_dist_key_prefix = trim(var.origin_bucket_dist_path, "/")
+
+  extension_mime_types = {
+    bmp    = "image/bmp"
+    css    = "text/css"
+    csv    = "text/csv"
+    gif    = "image/gif"
+    htm    = "text/html"
+    html   = "text/html"
+    ico    = "image/vnd.microsoft.icon"
+    jpeg   = "image/jpeg"
+    jpg    = "image/jpeg"
+    js     = "text/javascript"
+    json   = "application/json"
+    jsonld = "application/ld+json"
+    map    = "application/json" # assumes .js.map
+    otf    = "font/otf"
+    pdf    = "application/pdf"
+    png    = "image/png"
+    svg    = "image/svg+xml"
+    tif    = "image/tiff"
+    tiff   = "image/tiff"
+    ttf    = "font/ttf"
+    txt    = "text/plain"
+    woff   = "font/woff"
+    woff2  = "font/woff2"
+    xls    = "application/vnd.ms-excel"
+    xlsx   = "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
+    xml    = "application/xml"
+    webp   = "image/webp"
+  }
+}
+
+resource "aws_s3_object" "origin_dist_artifact" {
+  for_each = fileset(local.origin_artifacts_dist_path, "**")
+
+  bucket                 = module.origin_bucket.bucket_id
+  key                    = "${local.origin_artifacts_dist_key_prefix}/${each.value}"
+  source                 = "${local.origin_artifacts_dist_path}/${each.value}"
+  source_hash            = filemd5("${local.origin_artifacts_dist_path}/${each.value}")
+  etag                   = filemd5("${local.origin_artifacts_dist_path}/${each.value}")
+  server_side_encryption = "AES256"
+  content_type           = local.extension_mime_types[reverse(split(".", each.value))[0]]
+
+  depends_on = [module.origin_bucket]
+}
+
 module "logs_bucket" {
   source  = "cloudposse/s3-bucket/aws"
   version = "4.0.1"
diff --git a/terraform/modules/gost_website/variables.tf b/terraform/modules/gost_website/variables.tf
index 3a16a0ff9..336661527 100644
--- a/terraform/modules/gost_website/variables.tf
+++ b/terraform/modules/gost_website/variables.tf
@@ -77,6 +77,11 @@ variable "origin_bucket_dist_path" {
   }
 }
 
+variable "origin_artifacts_dist_path" {
+  description = "Path to the local directory from which website build artifacts are sourced and uploaded to the S3 origin bucket."
+  type        = string
+}
+
 variable "origin_bucket_config_path" {
   description = "Path to the directory where non-build configuration files should be stored in the S3 origin bucket."
   default     = "/config"
diff --git a/terraform/modules/gost_website/waf.tf b/terraform/modules/gost_website/waf.tf
index c08a0958f..41e400a85 100644
--- a/terraform/modules/gost_website/waf.tf
+++ b/terraform/modules/gost_website/waf.tf
@@ -18,7 +18,7 @@ locals {
 
 module "waf" {
   source         = "cloudposse/waf/aws"
-  version        = "0.4.0"
+  version        = "0.3.0"
   scope          = "CLOUDFRONT"
   default_action = "allow"
 
diff --git a/terraform/prod.tfvars b/terraform/prod.tfvars
index 24f81d09f..607fa46a7 100644
--- a/terraform/prod.tfvars
+++ b/terraform/prod.tfvars
@@ -49,12 +49,12 @@ cluster_container_insights_enabled = true
 
 // API / Backend
 api_enabled                           = true
-api_container_image_tag               = "stable"
 api_default_desired_task_count        = 3
 api_minumum_task_count                = 2
 api_maximum_task_count                = 5
 api_enable_grants_scraper             = false
 api_enable_grants_digest              = false
+api_enable_new_team_terminology       = false
 api_enable_saved_search_grants_digest = true
 api_log_retention_in_days             = 30
 api_datadog_environment_variables = {
diff --git a/terraform/sandbox.tfvars b/terraform/sandbox.tfvars
index 1169588f4..7ac2511da 100644
--- a/terraform/sandbox.tfvars
+++ b/terraform/sandbox.tfvars
@@ -30,6 +30,7 @@ api_minumum_task_count                = 1
 api_maximum_task_count                = 5
 api_enable_grants_scraper             = false
 api_enable_grants_digest              = false
+api_enable_new_team_terminology       = false
 api_enable_saved_search_grants_digest = false
 api_log_retention_in_days             = 7
 
diff --git a/terraform/staging.tfvars b/terraform/staging.tfvars
index 95fce1d61..33c639429 100644
--- a/terraform/staging.tfvars
+++ b/terraform/staging.tfvars
@@ -46,12 +46,12 @@ cluster_container_insights_enabled = true
 
 // API / Backend
 api_enabled                           = true
-api_container_image_tag               = "latest"
 api_default_desired_task_count        = 1
 api_minumum_task_count                = 1
 api_maximum_task_count                = 5
 api_enable_grants_scraper             = false
 api_enable_grants_digest              = false
+api_enable_new_team_terminology       = true
 api_enable_saved_search_grants_digest = true
 api_log_retention_in_days             = 14
 api_datadog_environment_variables = {
diff --git a/terraform/variables.tf b/terraform/variables.tf
index 8a0a9c1d2..2982291dc 100644
--- a/terraform/variables.tf
+++ b/terraform/variables.tf
@@ -112,6 +112,12 @@ variable "website_managed_waf_rules" {
   default = {}
 }
 
+variable "website_origin_artifacts_dist_path" {
+  description = "Path to the local directory from which website build artifacts are sourced and uploaded to the S3 origin bucket."
+  type        = string
+  default     = ""
+}
+
 variable "website_feature_flags" {
   description = "Map of website feature flag names and their values."
   type        = any
@@ -165,6 +171,10 @@ variable "api_enable_grants_digest" {
   type = bool
 }
 
+variable "api_enable_new_team_terminology" {
+  type = bool
+}
+
 variable "api_enable_saved_search_grants_digest" {
   type = bool
 }
diff --git a/yarn.lock b/yarn.lock
index bb0545eaf..35b4540da 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -221,26 +221,26 @@
     "@aws-sdk/util-utf8-browser" "^3.0.0"
     tslib "^1.11.1"
 
-"@aws-sdk/client-cognito-identity@3.454.0":
-  version "3.454.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/client-cognito-identity/-/client-cognito-identity-3.454.0.tgz#fba4360d912e04ff773dc249fcc55cae50364049"
-  integrity sha512-6Z3xYsgONJsZrn6P5XvKAgWxmUittGmp5jdX64LSz5OoPgkn0uGd01c2EACSKVivHUBc190gPg8Hg2BBmWjsMA==
+"@aws-sdk/client-cognito-identity@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/client-cognito-identity/-/client-cognito-identity-3.465.0.tgz#4d9082c9e9003f180649abeb216e9cbcdac8396b"
+  integrity sha512-Ku1034M9jjsXbLBS5DwQfcTwWwu2oxtmdbsxvEm4I7IUA/h1++hKPzZuJ6L9zo7I7GbA+WnCryviUdtbgCqTfA==
   dependencies:
     "@aws-crypto/sha256-browser" "3.0.0"
     "@aws-crypto/sha256-js" "3.0.0"
-    "@aws-sdk/client-sts" "3.454.0"
-    "@aws-sdk/core" "3.451.0"
-    "@aws-sdk/credential-provider-node" "3.451.0"
-    "@aws-sdk/middleware-host-header" "3.451.0"
-    "@aws-sdk/middleware-logger" "3.451.0"
-    "@aws-sdk/middleware-recursion-detection" "3.451.0"
-    "@aws-sdk/middleware-signing" "3.451.0"
-    "@aws-sdk/middleware-user-agent" "3.451.0"
-    "@aws-sdk/region-config-resolver" "3.451.0"
-    "@aws-sdk/types" "3.451.0"
-    "@aws-sdk/util-endpoints" "3.451.0"
-    "@aws-sdk/util-user-agent-browser" "3.451.0"
-    "@aws-sdk/util-user-agent-node" "3.451.0"
+    "@aws-sdk/client-sts" "3.465.0"
+    "@aws-sdk/core" "3.465.0"
+    "@aws-sdk/credential-provider-node" "3.465.0"
+    "@aws-sdk/middleware-host-header" "3.465.0"
+    "@aws-sdk/middleware-logger" "3.465.0"
+    "@aws-sdk/middleware-recursion-detection" "3.465.0"
+    "@aws-sdk/middleware-signing" "3.465.0"
+    "@aws-sdk/middleware-user-agent" "3.465.0"
+    "@aws-sdk/region-config-resolver" "3.465.0"
+    "@aws-sdk/types" "3.465.0"
+    "@aws-sdk/util-endpoints" "3.465.0"
+    "@aws-sdk/util-user-agent-browser" "3.465.0"
+    "@aws-sdk/util-user-agent-node" "3.465.0"
     "@smithy/config-resolver" "^2.0.18"
     "@smithy/fetch-http-handler" "^2.2.6"
     "@smithy/hash-node" "^2.0.15"
@@ -267,34 +267,34 @@
     tslib "^2.5.0"
 
 "@aws-sdk/client-s3@^3.312.0":
-  version "3.456.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/client-s3/-/client-s3-3.456.0.tgz#5bb5093545ab203bff2144c4bd9c6adc800b212e"
-  integrity sha512-987Mls+9w+mpdq4Vpc/OEQ93afkM12H7l97lIejcidZySuLVo5tdOM9ErekmgjAuotFzBgu2ExL83XtYIMgA0g==
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/client-s3/-/client-s3-3.465.0.tgz#7bad33ccfaa3d460247bbdb0e59c5ac7f4c3e2aa"
+  integrity sha512-S2W8aUs/SR7wabyKRldl5FKtAq2gsXo3BpbKjBvuCILwNl84ooQrsOmKtcVsINRdi+q/mZvwGenqqp/98+yjdg==
   dependencies:
     "@aws-crypto/sha1-browser" "3.0.0"
     "@aws-crypto/sha256-browser" "3.0.0"
     "@aws-crypto/sha256-js" "3.0.0"
-    "@aws-sdk/client-sts" "3.454.0"
-    "@aws-sdk/core" "3.451.0"
-    "@aws-sdk/credential-provider-node" "3.451.0"
-    "@aws-sdk/middleware-bucket-endpoint" "3.451.0"
-    "@aws-sdk/middleware-expect-continue" "3.451.0"
-    "@aws-sdk/middleware-flexible-checksums" "3.451.0"
-    "@aws-sdk/middleware-host-header" "3.451.0"
-    "@aws-sdk/middleware-location-constraint" "3.451.0"
-    "@aws-sdk/middleware-logger" "3.451.0"
-    "@aws-sdk/middleware-recursion-detection" "3.451.0"
-    "@aws-sdk/middleware-sdk-s3" "3.451.0"
-    "@aws-sdk/middleware-signing" "3.451.0"
-    "@aws-sdk/middleware-ssec" "3.451.0"
-    "@aws-sdk/middleware-user-agent" "3.451.0"
-    "@aws-sdk/region-config-resolver" "3.451.0"
-    "@aws-sdk/signature-v4-multi-region" "3.451.0"
-    "@aws-sdk/types" "3.451.0"
-    "@aws-sdk/util-endpoints" "3.451.0"
-    "@aws-sdk/util-user-agent-browser" "3.451.0"
-    "@aws-sdk/util-user-agent-node" "3.451.0"
-    "@aws-sdk/xml-builder" "3.310.0"
+    "@aws-sdk/client-sts" "3.465.0"
+    "@aws-sdk/core" "3.465.0"
+    "@aws-sdk/credential-provider-node" "3.465.0"
+    "@aws-sdk/middleware-bucket-endpoint" "3.465.0"
+    "@aws-sdk/middleware-expect-continue" "3.465.0"
+    "@aws-sdk/middleware-flexible-checksums" "3.465.0"
+    "@aws-sdk/middleware-host-header" "3.465.0"
+    "@aws-sdk/middleware-location-constraint" "3.465.0"
+    "@aws-sdk/middleware-logger" "3.465.0"
+    "@aws-sdk/middleware-recursion-detection" "3.465.0"
+    "@aws-sdk/middleware-sdk-s3" "3.465.0"
+    "@aws-sdk/middleware-signing" "3.465.0"
+    "@aws-sdk/middleware-ssec" "3.465.0"
+    "@aws-sdk/middleware-user-agent" "3.465.0"
+    "@aws-sdk/region-config-resolver" "3.465.0"
+    "@aws-sdk/signature-v4-multi-region" "3.465.0"
+    "@aws-sdk/types" "3.465.0"
+    "@aws-sdk/util-endpoints" "3.465.0"
+    "@aws-sdk/util-user-agent-browser" "3.465.0"
+    "@aws-sdk/util-user-agent-node" "3.465.0"
+    "@aws-sdk/xml-builder" "3.465.0"
     "@smithy/config-resolver" "^2.0.18"
     "@smithy/eventstream-serde-browser" "^2.0.13"
     "@smithy/eventstream-serde-config-resolver" "^2.0.13"
@@ -330,25 +330,25 @@
     tslib "^2.5.0"
 
 "@aws-sdk/client-ses@^3.312.0":
-  version "3.454.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/client-ses/-/client-ses-3.454.0.tgz#138411357dce5c25a75b946868171c7e97e0d203"
-  integrity sha512-6rLwDHHwjLv3gYL68V8sZeDlgiO60e/pIWmu2H7POoDTTFlQdcmS/ARdFzdIgAuA2yMAYFZvsFcrZTYxLl1q8g==
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/client-ses/-/client-ses-3.465.0.tgz#a298c592a4e8fafc81234e9ca9aa2a43c0af064d"
+  integrity sha512-eRIe4XjBOPRjk0nG0XdE+s6T2mxrQMJG1Z/L87YminZwIWhE9eL2EqyA8urARw6x/ovL3F3RsEjVBoNmr4TU6Q==
   dependencies:
     "@aws-crypto/sha256-browser" "3.0.0"
     "@aws-crypto/sha256-js" "3.0.0"
-    "@aws-sdk/client-sts" "3.454.0"
-    "@aws-sdk/core" "3.451.0"
-    "@aws-sdk/credential-provider-node" "3.451.0"
-    "@aws-sdk/middleware-host-header" "3.451.0"
-    "@aws-sdk/middleware-logger" "3.451.0"
-    "@aws-sdk/middleware-recursion-detection" "3.451.0"
-    "@aws-sdk/middleware-signing" "3.451.0"
-    "@aws-sdk/middleware-user-agent" "3.451.0"
-    "@aws-sdk/region-config-resolver" "3.451.0"
-    "@aws-sdk/types" "3.451.0"
-    "@aws-sdk/util-endpoints" "3.451.0"
-    "@aws-sdk/util-user-agent-browser" "3.451.0"
-    "@aws-sdk/util-user-agent-node" "3.451.0"
+    "@aws-sdk/client-sts" "3.465.0"
+    "@aws-sdk/core" "3.465.0"
+    "@aws-sdk/credential-provider-node" "3.465.0"
+    "@aws-sdk/middleware-host-header" "3.465.0"
+    "@aws-sdk/middleware-logger" "3.465.0"
+    "@aws-sdk/middleware-recursion-detection" "3.465.0"
+    "@aws-sdk/middleware-signing" "3.465.0"
+    "@aws-sdk/middleware-user-agent" "3.465.0"
+    "@aws-sdk/region-config-resolver" "3.465.0"
+    "@aws-sdk/types" "3.465.0"
+    "@aws-sdk/util-endpoints" "3.465.0"
+    "@aws-sdk/util-user-agent-browser" "3.465.0"
+    "@aws-sdk/util-user-agent-node" "3.465.0"
     "@smithy/config-resolver" "^2.0.18"
     "@smithy/fetch-http-handler" "^2.2.6"
     "@smithy/hash-node" "^2.0.15"
@@ -377,26 +377,26 @@
     tslib "^2.5.0"
 
 "@aws-sdk/client-sqs@^3.345.0":
-  version "3.454.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/client-sqs/-/client-sqs-3.454.0.tgz#c772faf558ff4b4851843df9b23e1b0822d638b5"
-  integrity sha512-eBviLavFxmXAbqL/wPlVqYnmS/hYUPj63ilQvFuj8zM3WYy0DX7GgvYXz5AUWswGsEk/4F88QFjlBM7N5miepw==
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/client-sqs/-/client-sqs-3.465.0.tgz#baae99b7f929f05c4a957855cb471bb1769c7d3f"
+  integrity sha512-yLUEWxSG4VJu/bK9p+OLSL/qc4vOQ57Dgj3aPwtk29u5JEEkGN4KTJZ70VgMDsqgcoWFUm7zWty9pRdNWF4vAw==
   dependencies:
     "@aws-crypto/sha256-browser" "3.0.0"
     "@aws-crypto/sha256-js" "3.0.0"
-    "@aws-sdk/client-sts" "3.454.0"
-    "@aws-sdk/core" "3.451.0"
-    "@aws-sdk/credential-provider-node" "3.451.0"
-    "@aws-sdk/middleware-host-header" "3.451.0"
-    "@aws-sdk/middleware-logger" "3.451.0"
-    "@aws-sdk/middleware-recursion-detection" "3.451.0"
-    "@aws-sdk/middleware-sdk-sqs" "3.451.0"
-    "@aws-sdk/middleware-signing" "3.451.0"
-    "@aws-sdk/middleware-user-agent" "3.451.0"
-    "@aws-sdk/region-config-resolver" "3.451.0"
-    "@aws-sdk/types" "3.451.0"
-    "@aws-sdk/util-endpoints" "3.451.0"
-    "@aws-sdk/util-user-agent-browser" "3.451.0"
-    "@aws-sdk/util-user-agent-node" "3.451.0"
+    "@aws-sdk/client-sts" "3.465.0"
+    "@aws-sdk/core" "3.465.0"
+    "@aws-sdk/credential-provider-node" "3.465.0"
+    "@aws-sdk/middleware-host-header" "3.465.0"
+    "@aws-sdk/middleware-logger" "3.465.0"
+    "@aws-sdk/middleware-recursion-detection" "3.465.0"
+    "@aws-sdk/middleware-sdk-sqs" "3.465.0"
+    "@aws-sdk/middleware-signing" "3.465.0"
+    "@aws-sdk/middleware-user-agent" "3.465.0"
+    "@aws-sdk/region-config-resolver" "3.465.0"
+    "@aws-sdk/types" "3.465.0"
+    "@aws-sdk/util-endpoints" "3.465.0"
+    "@aws-sdk/util-user-agent-browser" "3.465.0"
+    "@aws-sdk/util-user-agent-node" "3.465.0"
     "@smithy/config-resolver" "^2.0.18"
     "@smithy/fetch-http-handler" "^2.2.6"
     "@smithy/hash-node" "^2.0.15"
@@ -423,23 +423,23 @@
     "@smithy/util-utf8" "^2.0.2"
     tslib "^2.5.0"
 
-"@aws-sdk/client-sso@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/client-sso/-/client-sso-3.451.0.tgz#d52b961efa707b6579821942801145a2e1be8121"
-  integrity sha512-KkYSke3Pdv3MfVH/5fT528+MKjMyPKlcLcd4zQb0x6/7Bl7EHrPh1JZYjzPLHelb+UY5X0qN8+cb8iSu1eiwIQ==
+"@aws-sdk/client-sso@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/client-sso/-/client-sso-3.465.0.tgz#a732c640767d8d82c3c73d798720d0a8d355184d"
+  integrity sha512-JXDBa3Sl+LS0KEOs0PZoIjpNKEEGfeyFwdnRxi8Y1hMXNEKyJug1cI2Psqu2olpn4KeXwoP1BuITppZYdolOew==
   dependencies:
     "@aws-crypto/sha256-browser" "3.0.0"
     "@aws-crypto/sha256-js" "3.0.0"
-    "@aws-sdk/core" "3.451.0"
-    "@aws-sdk/middleware-host-header" "3.451.0"
-    "@aws-sdk/middleware-logger" "3.451.0"
-    "@aws-sdk/middleware-recursion-detection" "3.451.0"
-    "@aws-sdk/middleware-user-agent" "3.451.0"
-    "@aws-sdk/region-config-resolver" "3.451.0"
-    "@aws-sdk/types" "3.451.0"
-    "@aws-sdk/util-endpoints" "3.451.0"
-    "@aws-sdk/util-user-agent-browser" "3.451.0"
-    "@aws-sdk/util-user-agent-node" "3.451.0"
+    "@aws-sdk/core" "3.465.0"
+    "@aws-sdk/middleware-host-header" "3.465.0"
+    "@aws-sdk/middleware-logger" "3.465.0"
+    "@aws-sdk/middleware-recursion-detection" "3.465.0"
+    "@aws-sdk/middleware-user-agent" "3.465.0"
+    "@aws-sdk/region-config-resolver" "3.465.0"
+    "@aws-sdk/types" "3.465.0"
+    "@aws-sdk/util-endpoints" "3.465.0"
+    "@aws-sdk/util-user-agent-browser" "3.465.0"
+    "@aws-sdk/util-user-agent-node" "3.465.0"
     "@smithy/config-resolver" "^2.0.18"
     "@smithy/fetch-http-handler" "^2.2.6"
     "@smithy/hash-node" "^2.0.15"
@@ -465,26 +465,26 @@
     "@smithy/util-utf8" "^2.0.2"
     tslib "^2.5.0"
 
-"@aws-sdk/client-sts@3.454.0":
-  version "3.454.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/client-sts/-/client-sts-3.454.0.tgz#6106999e393c264a485fc76add374b375a2da8d5"
-  integrity sha512-0fDvr8WeB6IYO8BUCzcivWmahgGl/zDbaYfakzGnt4mrl5ztYaXE875WI6b7+oFcKMRvN+KLvwu5TtyFuNY+GQ==
+"@aws-sdk/client-sts@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/client-sts/-/client-sts-3.465.0.tgz#b356b90b0e31a82dc41995282245f74d023ea8b5"
+  integrity sha512-rHi9ba6ssNbVjlWSdhi4C5newEhGhzkY9UE4KB+/Tj21zXfEP8r6uIltnQXPtun2SdA95Krh/yS1qQ4MRuzqyA==
   dependencies:
     "@aws-crypto/sha256-browser" "3.0.0"
     "@aws-crypto/sha256-js" "3.0.0"
-    "@aws-sdk/core" "3.451.0"
-    "@aws-sdk/credential-provider-node" "3.451.0"
-    "@aws-sdk/middleware-host-header" "3.451.0"
-    "@aws-sdk/middleware-logger" "3.451.0"
-    "@aws-sdk/middleware-recursion-detection" "3.451.0"
-    "@aws-sdk/middleware-sdk-sts" "3.451.0"
-    "@aws-sdk/middleware-signing" "3.451.0"
-    "@aws-sdk/middleware-user-agent" "3.451.0"
-    "@aws-sdk/region-config-resolver" "3.451.0"
-    "@aws-sdk/types" "3.451.0"
-    "@aws-sdk/util-endpoints" "3.451.0"
-    "@aws-sdk/util-user-agent-browser" "3.451.0"
-    "@aws-sdk/util-user-agent-node" "3.451.0"
+    "@aws-sdk/core" "3.465.0"
+    "@aws-sdk/credential-provider-node" "3.465.0"
+    "@aws-sdk/middleware-host-header" "3.465.0"
+    "@aws-sdk/middleware-logger" "3.465.0"
+    "@aws-sdk/middleware-recursion-detection" "3.465.0"
+    "@aws-sdk/middleware-sdk-sts" "3.465.0"
+    "@aws-sdk/middleware-signing" "3.465.0"
+    "@aws-sdk/middleware-user-agent" "3.465.0"
+    "@aws-sdk/region-config-resolver" "3.465.0"
+    "@aws-sdk/types" "3.465.0"
+    "@aws-sdk/util-endpoints" "3.465.0"
+    "@aws-sdk/util-user-agent-browser" "3.465.0"
+    "@aws-sdk/util-user-agent-node" "3.465.0"
     "@smithy/config-resolver" "^2.0.18"
     "@smithy/fetch-http-handler" "^2.2.6"
     "@smithy/hash-node" "^2.0.15"
@@ -511,41 +511,41 @@
     fast-xml-parser "4.2.5"
     tslib "^2.5.0"
 
-"@aws-sdk/core@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/core/-/core-3.451.0.tgz#ecd30da40d8e02050a772920485f450ea2a1b804"
-  integrity sha512-SamWW2zHEf1ZKe3j1w0Piauryl8BQIlej0TBS18A4ACzhjhWXhCs13bO1S88LvPR5mBFXok3XOT6zPOnKDFktw==
+"@aws-sdk/core@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/core/-/core-3.465.0.tgz#bfc9dd0fbd953f0839666e9b24c50c4543f49112"
+  integrity sha512-fHSIw/Rgex3KbrEKn6ZrUc2VcsOTpdBMeyYtfmsTOLSyDDOG9k3jelOvVbCbrK5N6uEUSM8hrnySEKg94UB0cg==
   dependencies:
     "@smithy/smithy-client" "^2.1.15"
     tslib "^2.5.0"
 
-"@aws-sdk/credential-provider-cognito-identity@3.454.0":
-  version "3.454.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-cognito-identity/-/credential-provider-cognito-identity-3.454.0.tgz#664b06aa5c85a214edcfc573169502fa33099533"
-  integrity sha512-sRxDhZKgFasAVajNvpqJMEOCvtCUfofVcUO5vIp8jgPHNw5yrN5REZStjVjgYO5riFKXFI8qqHHtzttx+HhsZg==
+"@aws-sdk/credential-provider-cognito-identity@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-cognito-identity/-/credential-provider-cognito-identity-3.465.0.tgz#e278ba1849c3cd38e6a8eb655a931ac2fdddc88a"
+  integrity sha512-bvZNgA2Cx54eTSZm2bXCUbz5rQjcNqTONuvjNIl1CFK9lEj3o3rRU1EqAwX6AIrT1OIstnDr1Z6llxjwvTLqiA==
   dependencies:
-    "@aws-sdk/client-cognito-identity" "3.454.0"
-    "@aws-sdk/types" "3.451.0"
+    "@aws-sdk/client-cognito-identity" "3.465.0"
+    "@aws-sdk/types" "3.465.0"
     "@smithy/property-provider" "^2.0.0"
     "@smithy/types" "^2.5.0"
     tslib "^2.5.0"
 
-"@aws-sdk/credential-provider-env@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-env/-/credential-provider-env-3.451.0.tgz#7b7429bd2e3fdebf914a88269274190781aeeab2"
-  integrity sha512-9dAav7DcRgaF7xCJEQR5ER9ErXxnu/tdnVJ+UPmb1NPeIZdESv1A3lxFDEq1Fs8c4/lzAj9BpshGyJVIZwZDKg==
+"@aws-sdk/credential-provider-env@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-env/-/credential-provider-env-3.465.0.tgz#9bb1c2086165872ad024786e5a48ccb31c5438da"
+  integrity sha512-fku37AgkB9KhCuWHE6mfvbWYU0X84Df6MQ60nYH7s/PiNEhkX2cVI6X6kOKjP1MNIwRcYt+oQDvplVKdHume+A==
   dependencies:
-    "@aws-sdk/types" "3.451.0"
+    "@aws-sdk/types" "3.465.0"
     "@smithy/property-provider" "^2.0.0"
     "@smithy/types" "^2.5.0"
     tslib "^2.5.0"
 
-"@aws-sdk/credential-provider-http@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-http/-/credential-provider-http-3.451.0.tgz#8e70dfc42e9e96156b9b3c4dbdd82f1cc32249fc"
-  integrity sha512-q82kEzymqimkJ2dHmuN2RGpi9HTFSxwwoXALnzPRaRcvR/v+YY8FMgSTfwXzPkHUDf/q8J+aDz6lPcYlnsP3sQ==
+"@aws-sdk/credential-provider-http@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-http/-/credential-provider-http-3.465.0.tgz#77031a962c139a62078d7c72c4fb5ccfc2628df0"
+  integrity sha512-Rj/zFgP0i0tpuaO+sm1csGU7NLQa1F9eE9c3VKbYECiXAZwrGJnY1TdG2iSsLpkMtyfOhRrRvAuYAUCUemWg3g==
   dependencies:
-    "@aws-sdk/types" "3.451.0"
+    "@aws-sdk/types" "3.465.0"
     "@smithy/fetch-http-handler" "^2.2.6"
     "@smithy/node-http-handler" "^2.1.9"
     "@smithy/property-provider" "^2.0.0"
@@ -555,209 +555,212 @@
     "@smithy/util-stream" "^2.0.20"
     tslib "^2.5.0"
 
-"@aws-sdk/credential-provider-ini@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-ini/-/credential-provider-ini-3.451.0.tgz#e38315611f70700ad9803316d7030e3472c9789c"
-  integrity sha512-TySt64Ci5/ZbqFw1F9Z0FIGvYx5JSC9e6gqDnizIYd8eMnn8wFRUscRrD7pIHKfrhvVKN5h0GdYovmMO/FMCBw==
+"@aws-sdk/credential-provider-ini@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-ini/-/credential-provider-ini-3.465.0.tgz#d3c3596cc5ff5ebe372bbd62d7aac044cbf3e2e3"
+  integrity sha512-B1MFufvdToAEMtfszilVnKer2S7P/OfMhkCizq2zuu8aU/CquRyHvKEQgWdvqunUDrFnVTc0kUZgsbBY0uPjLg==
   dependencies:
-    "@aws-sdk/credential-provider-env" "3.451.0"
-    "@aws-sdk/credential-provider-process" "3.451.0"
-    "@aws-sdk/credential-provider-sso" "3.451.0"
-    "@aws-sdk/credential-provider-web-identity" "3.451.0"
-    "@aws-sdk/types" "3.451.0"
+    "@aws-sdk/credential-provider-env" "3.465.0"
+    "@aws-sdk/credential-provider-process" "3.465.0"
+    "@aws-sdk/credential-provider-sso" "3.465.0"
+    "@aws-sdk/credential-provider-web-identity" "3.465.0"
+    "@aws-sdk/types" "3.465.0"
     "@smithy/credential-provider-imds" "^2.0.0"
     "@smithy/property-provider" "^2.0.0"
     "@smithy/shared-ini-file-loader" "^2.0.6"
     "@smithy/types" "^2.5.0"
     tslib "^2.5.0"
 
-"@aws-sdk/credential-provider-node@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-node/-/credential-provider-node-3.451.0.tgz#72ccdef2199104379977dc06ea84c8d2a356d545"
-  integrity sha512-AEwM1WPyxUdKrKyUsKyFqqRFGU70e4qlDyrtBxJnSU9NRLZI8tfEZ67bN7fHSxBUBODgDXpMSlSvJiBLh5/3pw==
-  dependencies:
-    "@aws-sdk/credential-provider-env" "3.451.0"
-    "@aws-sdk/credential-provider-ini" "3.451.0"
-    "@aws-sdk/credential-provider-process" "3.451.0"
-    "@aws-sdk/credential-provider-sso" "3.451.0"
-    "@aws-sdk/credential-provider-web-identity" "3.451.0"
-    "@aws-sdk/types" "3.451.0"
+"@aws-sdk/credential-provider-node@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-node/-/credential-provider-node-3.465.0.tgz#b11cbc927aa17aacd0b7208cef5a88045c0bcf62"
+  integrity sha512-R3VA9yJ0BvezvrDxcgPTv9VHbVPbzchLTrX5jLFSVuW/lPPYLUi/Cjtyg9C9Y7qRfoQS4fNMvSRhwO5/TF68gA==
+  dependencies:
+    "@aws-sdk/credential-provider-env" "3.465.0"
+    "@aws-sdk/credential-provider-ini" "3.465.0"
+    "@aws-sdk/credential-provider-process" "3.465.0"
+    "@aws-sdk/credential-provider-sso" "3.465.0"
+    "@aws-sdk/credential-provider-web-identity" "3.465.0"
+    "@aws-sdk/types" "3.465.0"
     "@smithy/credential-provider-imds" "^2.0.0"
     "@smithy/property-provider" "^2.0.0"
     "@smithy/shared-ini-file-loader" "^2.0.6"
     "@smithy/types" "^2.5.0"
     tslib "^2.5.0"
 
-"@aws-sdk/credential-provider-process@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-process/-/credential-provider-process-3.451.0.tgz#3dd1d7df235f4eeb99d7e0f16b0e8cd61d555a73"
-  integrity sha512-HQywSdKeD5PErcLLnZfSyCJO+6T+ZyzF+Lm/QgscSC+CbSUSIPi//s15qhBRVely/3KBV6AywxwNH+5eYgt4lQ==
+"@aws-sdk/credential-provider-process@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-process/-/credential-provider-process-3.465.0.tgz#78134b19f7a02e7fb78afda16d7cae5b93ff324e"
+  integrity sha512-YE6ZrRYwvb8969hWQnr4uvOJ8RU0JrNsk3vWTe/czly37ioZUEhi8jmpQp4f2mX/6U6buoFGWu5Se3VCdw2SFQ==
   dependencies:
-    "@aws-sdk/types" "3.451.0"
+    "@aws-sdk/types" "3.465.0"
     "@smithy/property-provider" "^2.0.0"
     "@smithy/shared-ini-file-loader" "^2.0.6"
     "@smithy/types" "^2.5.0"
     tslib "^2.5.0"
 
-"@aws-sdk/credential-provider-sso@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-sso/-/credential-provider-sso-3.451.0.tgz#f2482985a80f1da78e6b50ffaebbf2297d0f366f"
-  integrity sha512-Usm/N51+unOt8ID4HnQzxIjUJDrkAQ1vyTOC0gSEEJ7h64NSSPGD5yhN7il5WcErtRd3EEtT1a8/GTC5TdBctg==
+"@aws-sdk/credential-provider-sso@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-sso/-/credential-provider-sso-3.465.0.tgz#622d03eb5c8a0d7a48ba12e849351c841eb48ca6"
+  integrity sha512-tLIP/4JQIJpn8yIg6RZRQ2nmvj5i4wLZvYvY4RtaFv2JrQUkmmTfyOZJuOBrIFRwJjx0fHmFu8DJjcOhMzllIQ==
   dependencies:
-    "@aws-sdk/client-sso" "3.451.0"
-    "@aws-sdk/token-providers" "3.451.0"
-    "@aws-sdk/types" "3.451.0"
+    "@aws-sdk/client-sso" "3.465.0"
+    "@aws-sdk/token-providers" "3.465.0"
+    "@aws-sdk/types" "3.465.0"
     "@smithy/property-provider" "^2.0.0"
     "@smithy/shared-ini-file-loader" "^2.0.6"
     "@smithy/types" "^2.5.0"
     tslib "^2.5.0"
 
-"@aws-sdk/credential-provider-web-identity@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-web-identity/-/credential-provider-web-identity-3.451.0.tgz#5dc40768869d5887888c6f178c7831dd2c74cfbe"
-  integrity sha512-Xtg3Qw65EfDjWNG7o2xD6sEmumPfsy3WDGjk2phEzVg8s7hcZGxf5wYwe6UY7RJvlEKrU0rFA+AMn6Hfj5oOzg==
+"@aws-sdk/credential-provider-web-identity@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-web-identity/-/credential-provider-web-identity-3.465.0.tgz#9db18766eeb0c58a99f7fb5d4bd95f0cf9008d4d"
+  integrity sha512-B4Y75fMTZIniEU0yyqat+9NsQbYlXdqP5Y3bShkaG3pGLOHzF/xMlWuG+D3kkQ806PLYi+BgfVls4BcO+NyVcA==
   dependencies:
-    "@aws-sdk/types" "3.451.0"
+    "@aws-sdk/types" "3.465.0"
     "@smithy/property-provider" "^2.0.0"
     "@smithy/types" "^2.5.0"
     tslib "^2.5.0"
 
-"@aws-sdk/credential-providers@3.454.0":
-  version "3.454.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-providers/-/credential-providers-3.454.0.tgz#2ee4925044555cdf8ef5a1b3e899ddc4304a09e0"
-  integrity sha512-y+ieaocH6T5pjGx7l2NUTb2n29URUYO3uYSvvwoWKx/KK17QJEVKMbARHBHyvDIbybeHidJTO58Jz5AY7rcTQA==
-  dependencies:
-    "@aws-sdk/client-cognito-identity" "3.454.0"
-    "@aws-sdk/client-sso" "3.451.0"
-    "@aws-sdk/client-sts" "3.454.0"
-    "@aws-sdk/credential-provider-cognito-identity" "3.454.0"
-    "@aws-sdk/credential-provider-env" "3.451.0"
-    "@aws-sdk/credential-provider-http" "3.451.0"
-    "@aws-sdk/credential-provider-ini" "3.451.0"
-    "@aws-sdk/credential-provider-node" "3.451.0"
-    "@aws-sdk/credential-provider-process" "3.451.0"
-    "@aws-sdk/credential-provider-sso" "3.451.0"
-    "@aws-sdk/credential-provider-web-identity" "3.451.0"
-    "@aws-sdk/types" "3.451.0"
+"@aws-sdk/credential-providers@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-providers/-/credential-providers-3.465.0.tgz#841000b3d548fac20df3011d7945af0283d1bcf9"
+  integrity sha512-mtndyew33Fnv30zVCQLBkqvUeFvjAlgAe3yM/10U//dxsOW3pfYWZ6sMzDbuXHLCyROQXJqZfnsQKQs0rOaO0Q==
+  dependencies:
+    "@aws-sdk/client-cognito-identity" "3.465.0"
+    "@aws-sdk/client-sso" "3.465.0"
+    "@aws-sdk/client-sts" "3.465.0"
+    "@aws-sdk/credential-provider-cognito-identity" "3.465.0"
+    "@aws-sdk/credential-provider-env" "3.465.0"
+    "@aws-sdk/credential-provider-http" "3.465.0"
+    "@aws-sdk/credential-provider-ini" "3.465.0"
+    "@aws-sdk/credential-provider-node" "3.465.0"
+    "@aws-sdk/credential-provider-process" "3.465.0"
+    "@aws-sdk/credential-provider-sso" "3.465.0"
+    "@aws-sdk/credential-provider-web-identity" "3.465.0"
+    "@aws-sdk/types" "3.465.0"
     "@smithy/credential-provider-imds" "^2.0.0"
     "@smithy/property-provider" "^2.0.0"
     "@smithy/types" "^2.5.0"
     tslib "^2.5.0"
 
-"@aws-sdk/middleware-bucket-endpoint@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-bucket-endpoint/-/middleware-bucket-endpoint-3.451.0.tgz#d2853e30605771414fff762cd7680e449e3c811e"
-  integrity sha512-KWyZ1JGnYz2QbHuJtYTP1BVnMOfVopR8rP8dTinVb/JR5HfAYz4imICJlJUbOYRjN7wpA3PrRI8dNRjrSBjWJg==
+"@aws-sdk/middleware-bucket-endpoint@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-bucket-endpoint/-/middleware-bucket-endpoint-3.465.0.tgz#215489d3cbdac037c3d5abaeabda173c3bc16b95"
+  integrity sha512-cyIR9Nwyie6giLypuLSUmZF3O5GqVRwia3Nq1B/6/Ho0LccH0/HT2x/nM8fFcnskWSNGTVZVvZzSrVYXynTtjA==
   dependencies:
-    "@aws-sdk/types" "3.451.0"
-    "@aws-sdk/util-arn-parser" "3.310.0"
+    "@aws-sdk/types" "3.465.0"
+    "@aws-sdk/util-arn-parser" "3.465.0"
     "@smithy/node-config-provider" "^2.1.5"
     "@smithy/protocol-http" "^3.0.9"
     "@smithy/types" "^2.5.0"
     "@smithy/util-config-provider" "^2.0.0"
     tslib "^2.5.0"
 
-"@aws-sdk/middleware-expect-continue@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-expect-continue/-/middleware-expect-continue-3.451.0.tgz#6fa15a51d7d894230fa6cdf8989755f476005fff"
-  integrity sha512-vwG8o2Uk6biLDlOZnqXemsO4dS2HvrprUdxyouwu6hlzLFskg8nL122butn19JqXJKgcVLuSSLzT+xwqBWy2Rg==
+"@aws-sdk/middleware-expect-continue@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-expect-continue/-/middleware-expect-continue-3.465.0.tgz#760aec6a19898972a4d97857ea2760bcd191c791"
+  integrity sha512-kthlPQDASsdtdVqKVKkJn9bHptcEpsQ6ptWeGBCYigicULvWI1fjSTeXrYczxNMVg+1Sv8xkb/bh+kUEu7mvZg==
   dependencies:
-    "@aws-sdk/types" "3.451.0"
+    "@aws-sdk/types" "3.465.0"
     "@smithy/protocol-http" "^3.0.9"
     "@smithy/types" "^2.5.0"
     tslib "^2.5.0"
 
-"@aws-sdk/middleware-flexible-checksums@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-flexible-checksums/-/middleware-flexible-checksums-3.451.0.tgz#3617c35bceafcebd77faef5f47a3cfedc20d713c"
-  integrity sha512-eOkpcC2zgAvqs1w7Yp5nsk9LBIj6qLU5kaZuZEBOiFbNKIrTnPo6dQuhgvDcKHD6Y5W/cUjSBiFMs/ROb5aoug==
+"@aws-sdk/middleware-flexible-checksums@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-flexible-checksums/-/middleware-flexible-checksums-3.465.0.tgz#7b629873182bc107159665f0af5b6515161c8891"
+  integrity sha512-joWEWN0v1CpI4q9JlZki0AchVwLL8Les0+V+3JHVDcDgL4RQ04YUk9lMYbtldDwdyBNquKwW2+sGtIo/6ng0Tg==
   dependencies:
     "@aws-crypto/crc32" "3.0.0"
     "@aws-crypto/crc32c" "3.0.0"
-    "@aws-sdk/types" "3.451.0"
+    "@aws-sdk/types" "3.465.0"
     "@smithy/is-array-buffer" "^2.0.0"
     "@smithy/protocol-http" "^3.0.9"
     "@smithy/types" "^2.5.0"
     "@smithy/util-utf8" "^2.0.2"
     tslib "^2.5.0"
 
-"@aws-sdk/middleware-host-header@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-host-header/-/middleware-host-header-3.451.0.tgz#016fcd2b0ec58f26ce62c7ff792174bdf580972b"
-  integrity sha512-j8a5jAfhWmsK99i2k8oR8zzQgXrsJtgrLxc3js6U+525mcZytoiDndkWTmD5fjJ1byU1U2E5TaPq+QJeDip05Q==
+"@aws-sdk/middleware-host-header@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-host-header/-/middleware-host-header-3.465.0.tgz#4f353f6ea063e1ba1df968f9f0126a53d746217d"
+  integrity sha512-nnGva8eplwEJqdVzcb+xF2Fwua0PpiwxMEvpnIy73gNbetbJdgFIprryMLYes00xzJEqnew+LWdpcd3YyS34ZA==
   dependencies:
-    "@aws-sdk/types" "3.451.0"
+    "@aws-sdk/types" "3.465.0"
     "@smithy/protocol-http" "^3.0.9"
     "@smithy/types" "^2.5.0"
     tslib "^2.5.0"
 
-"@aws-sdk/middleware-location-constraint@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-location-constraint/-/middleware-location-constraint-3.451.0.tgz#eb763e777b008e7f9fef3eda8dbfce27ed54cdaa"
-  integrity sha512-R4U2G7mybP0BMiQBJWTcB47g49F4PSXTiCsvMDp5WOEhpWvGQuO1ZIhTxCl5s5lgTSne063Os8W6KSdK2yG2TQ==
+"@aws-sdk/middleware-location-constraint@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-location-constraint/-/middleware-location-constraint-3.465.0.tgz#ce2f09d3257bd288990e567f406e74bbe08a5663"
+  integrity sha512-2+mwaI/ltE2ibr5poC+E9kJRfVIv7aHpAJkLu7uvESch9cpuFuGJu6fq0/gA82eKZ/gwpBj+AaXBsDFfsDWFsw==
   dependencies:
-    "@aws-sdk/types" "3.451.0"
+    "@aws-sdk/types" "3.465.0"
     "@smithy/types" "^2.5.0"
     tslib "^2.5.0"
 
-"@aws-sdk/middleware-logger@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-logger/-/middleware-logger-3.451.0.tgz#9ef8ac916199f92ea1bb6c153279727ffa2b0b36"
-  integrity sha512-0kHrYEyVeB2QBfP6TfbI240aRtatLZtcErJbhpiNUb+CQPgEL3crIjgVE8yYiJumZ7f0jyjo8HLPkwD1/2APaw==
+"@aws-sdk/middleware-logger@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-logger/-/middleware-logger-3.465.0.tgz#7d66b375ee343f00e35c64ba79b37656828bf171"
+  integrity sha512-aGMx1aSlzDDgjZ7fSxLhGD5rkyCfHwq04TSB5fQAgDBqUjj4IQXZwmNglX0sLRmArXZtDglUVESOfKvTANJTPg==
   dependencies:
-    "@aws-sdk/types" "3.451.0"
+    "@aws-sdk/types" "3.465.0"
     "@smithy/types" "^2.5.0"
     tslib "^2.5.0"
 
-"@aws-sdk/middleware-recursion-detection@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-recursion-detection/-/middleware-recursion-detection-3.451.0.tgz#333a12d4792788bfcc3cab1028868cf37fb17e76"
-  integrity sha512-J6jL6gJ7orjHGM70KDRcCP7so/J2SnkN4vZ9YRLTeeZY6zvBuHDjX8GCIgSqPn/nXFXckZO8XSnA7u6+3TAT0w==
+"@aws-sdk/middleware-recursion-detection@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-recursion-detection/-/middleware-recursion-detection-3.465.0.tgz#d0cb1fd9c63dbe997406253b5e0ce402103d910f"
+  integrity sha512-ol3dlsTnryBhV5qkUvK5Yg3dRaV1NXIxYJaIkShrl8XAv4wRNcDJDmO5NYq5eVZ3zgV1nv6xIpZ//dDnnf6Z+g==
   dependencies:
-    "@aws-sdk/types" "3.451.0"
+    "@aws-sdk/types" "3.465.0"
     "@smithy/protocol-http" "^3.0.9"
     "@smithy/types" "^2.5.0"
     tslib "^2.5.0"
 
-"@aws-sdk/middleware-sdk-s3@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-sdk-s3/-/middleware-sdk-s3-3.451.0.tgz#2c9b47216b46fcb46e6a505463059eff89912cec"
-  integrity sha512-XF4Cw8HrYUwGLKOqKtWs6ss1WXoxvQUcgGLACGSqn9a0p51446NiS5671x7qJUsfBuygdKlIKcOc8pPr9a+5Ow==
+"@aws-sdk/middleware-sdk-s3@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-sdk-s3/-/middleware-sdk-s3-3.465.0.tgz#fd417ce7a958066afb5c293b49eacd2f807e853e"
+  integrity sha512-P4cpNv0EcMSSLojjqKKQjKSGZc13QJQAscUs+fcvpBg2BNR9ByxrQgXXMqQiIqr8fgAhADqN2Tp8hJk0CzfnAg==
   dependencies:
-    "@aws-sdk/types" "3.451.0"
-    "@aws-sdk/util-arn-parser" "3.310.0"
+    "@aws-sdk/types" "3.465.0"
+    "@aws-sdk/util-arn-parser" "3.465.0"
+    "@smithy/node-config-provider" "^2.1.5"
     "@smithy/protocol-http" "^3.0.9"
+    "@smithy/signature-v4" "^2.0.0"
     "@smithy/smithy-client" "^2.1.15"
     "@smithy/types" "^2.5.0"
+    "@smithy/util-config-provider" "^2.0.0"
     tslib "^2.5.0"
 
-"@aws-sdk/middleware-sdk-sqs@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-sdk-sqs/-/middleware-sdk-sqs-3.451.0.tgz#0ab86d64ad628babfb6fed2def999681c0eb3e9f"
-  integrity sha512-GXpFSc9Ji4IAT/OaTkmnDrxzZrrAsJctUAC9vihpgGDof79A1Oz4R+r2uBMTKGxCIFkqyYW5Se7y2ijjTNa3ZA==
+"@aws-sdk/middleware-sdk-sqs@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-sdk-sqs/-/middleware-sdk-sqs-3.465.0.tgz#2cae0091ad73d854349347c0e4b717c71786f154"
+  integrity sha512-vEROtdj6ZaUm39Lv9K5UBo4k5OUiaWD1MwL3IdTikFBFbuYfNuZoq8MQxxziOq5pH6DTfXZwuAC1LvYx6b2+gw==
   dependencies:
-    "@aws-sdk/types" "3.451.0"
+    "@aws-sdk/types" "3.465.0"
     "@smithy/types" "^2.5.0"
     "@smithy/util-hex-encoding" "^2.0.0"
     "@smithy/util-utf8" "^2.0.2"
     tslib "^2.5.0"
 
-"@aws-sdk/middleware-sdk-sts@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-sdk-sts/-/middleware-sdk-sts-3.451.0.tgz#0c70b57523386fe12357b4471cd20b681a27f9aa"
-  integrity sha512-UJ6UfVUEgp0KIztxpAeelPXI5MLj9wUtUCqYeIMP7C1ZhoEMNm3G39VLkGN43dNhBf1LqjsV9jkKMZbVfYXuwg==
+"@aws-sdk/middleware-sdk-sts@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-sdk-sts/-/middleware-sdk-sts-3.465.0.tgz#73ad1f0940f924be1141125ceffcf4204c54c9bf"
+  integrity sha512-PmTM5ycUe1RLAPrQXLCR8JzKamJuKDB0aIW4rx4/skurzWsEGRI47WHggf9N7sPie41IBGUhRbXcf7sfPjvI3Q==
   dependencies:
-    "@aws-sdk/middleware-signing" "3.451.0"
-    "@aws-sdk/types" "3.451.0"
+    "@aws-sdk/middleware-signing" "3.465.0"
+    "@aws-sdk/types" "3.465.0"
     "@smithy/types" "^2.5.0"
     tslib "^2.5.0"
 
-"@aws-sdk/middleware-signing@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-signing/-/middleware-signing-3.451.0.tgz#ed7f5665dd048228e00f8e7e5925db32901a7886"
-  integrity sha512-s5ZlcIoLNg1Huj4Qp06iKniE8nJt/Pj1B/fjhWc6cCPCM7XJYUCejCnRh6C5ZJoBEYodjuwZBejPc1Wh3j+znA==
+"@aws-sdk/middleware-signing@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-signing/-/middleware-signing-3.465.0.tgz#2a040c39bfd6f2528ef9798944b4de2d33d2bdd1"
+  integrity sha512-d90KONWXSC3jA0kqJ6u8ygS4LoMg1TmSM7bPhHyibJVAEhnrlB4Aq1CWljNbbtphGpdKy5/XRM9O0/XCXWKQ4w==
   dependencies:
-    "@aws-sdk/types" "3.451.0"
+    "@aws-sdk/types" "3.465.0"
     "@smithy/property-provider" "^2.0.0"
     "@smithy/protocol-http" "^3.0.9"
     "@smithy/signature-v4" "^2.0.0"
@@ -765,35 +768,35 @@
     "@smithy/util-middleware" "^2.0.6"
     tslib "^2.5.0"
 
-"@aws-sdk/middleware-ssec@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-ssec/-/middleware-ssec-3.451.0.tgz#056e4c8afc54651481d81d6c54fc0599c70f5c67"
-  integrity sha512-hDkeBUiRsvuDbvsPha0/uJHE680WDzjAOoE6ZnLBoWsw7ry+Bw1ULMj0sCmpBVrQ7Gpivi/6zbezhClVmt3ITw==
+"@aws-sdk/middleware-ssec@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-ssec/-/middleware-ssec-3.465.0.tgz#ca6aff262527f0089a003afa33e901b81908f486"
+  integrity sha512-PHc1guBGp7fwoPlJkAEaHVkiYPfs93jffwsBvIevCsHcfYPv6L26/5Nk7KR+6IyuGQHpUbSC080SP1jYjOy01A==
   dependencies:
-    "@aws-sdk/types" "3.451.0"
+    "@aws-sdk/types" "3.465.0"
     "@smithy/types" "^2.5.0"
     tslib "^2.5.0"
 
-"@aws-sdk/middleware-user-agent@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-user-agent/-/middleware-user-agent-3.451.0.tgz#33d168e8411be4561eeef69e16c31e41b6f9a0cf"
-  integrity sha512-8NM/0JiKLNvT9wtAQVl1DFW0cEO7OvZyLSUBLNLTHqyvOZxKaZ8YFk7d8PL6l76LeUKRxq4NMxfZQlUIRe0eSA==
+"@aws-sdk/middleware-user-agent@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-user-agent/-/middleware-user-agent-3.465.0.tgz#2820d55ff7d774a4afe60f85fe88d959171f9052"
+  integrity sha512-1MvIWMj2nktLOJN8Kh4jiTK28oL85fTeoXHZ+V8xYMzont6C6Y8gQPtg7ka+RotHwqWMrovfnANisnX8EzEP/Q==
   dependencies:
-    "@aws-sdk/types" "3.451.0"
-    "@aws-sdk/util-endpoints" "3.451.0"
+    "@aws-sdk/types" "3.465.0"
+    "@aws-sdk/util-endpoints" "3.465.0"
     "@smithy/protocol-http" "^3.0.9"
     "@smithy/types" "^2.5.0"
     tslib "^2.5.0"
 
 "@aws-sdk/rds-signer@^3.315.0":
-  version "3.454.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/rds-signer/-/rds-signer-3.454.0.tgz#6aad8be212846a32293ef4dc278acbeefb4f3ecb"
-  integrity sha512-nZ8W7ccdk029v62LiNfSOQ5FNhJ+pm9b7YxLle34lX/frrZNXJ2XtgcnTMc8zR3/nZAkDZs3vFDuRqSQxytXGg==
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/rds-signer/-/rds-signer-3.465.0.tgz#cef22fd48db12bc185a0492dc6f0e38dc66111ff"
+  integrity sha512-fhui4CZz7khGsnok93HHSziSMYw8/K4o99Bk8UKSDtkmBMnmkJ87Kl2pCjrqk4iywmJHqO6WjbTmi+WXN3nbgg==
   dependencies:
     "@aws-crypto/sha256-browser" "3.0.0"
     "@aws-crypto/sha256-js" "3.0.0"
-    "@aws-sdk/credential-providers" "3.454.0"
-    "@aws-sdk/util-format-url" "3.451.0"
+    "@aws-sdk/credential-providers" "3.465.0"
+    "@aws-sdk/util-format-url" "3.465.0"
     "@smithy/config-resolver" "^2.0.18"
     "@smithy/hash-node" "^2.0.15"
     "@smithy/invalid-dependency" "^2.0.13"
@@ -803,10 +806,10 @@
     "@smithy/types" "^2.5.0"
     tslib "^2.5.0"
 
-"@aws-sdk/region-config-resolver@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/region-config-resolver/-/region-config-resolver-3.451.0.tgz#f4de34ebe435832dd6bcdc0a7b9fae14a42fc6de"
-  integrity sha512-3iMf4OwzrFb4tAAmoROXaiORUk2FvSejnHIw/XHvf/jjR4EqGGF95NZP/n/MeFZMizJWVssrwS412GmoEyoqhg==
+"@aws-sdk/region-config-resolver@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/region-config-resolver/-/region-config-resolver-3.465.0.tgz#87c3d2fe96e1e759d818f179f1e72204791145e6"
+  integrity sha512-h0Phd2Ae873dsPSWuxqxz2yRC5NMeeWxQiJPh4j42HF8g7dZK7tMQPkYznAoA/BzSBsEX87sbr3MmigquSyUTA==
   dependencies:
     "@smithy/node-config-provider" "^2.1.5"
     "@smithy/types" "^2.5.0"
@@ -815,46 +818,47 @@
     tslib "^2.5.0"
 
 "@aws-sdk/s3-request-presigner@^3.312.0":
-  version "3.456.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/s3-request-presigner/-/s3-request-presigner-3.456.0.tgz#1802178521493a65e8e785b8f22e9c114b2c7cc9"
-  integrity sha512-f7xATU5D4Gn5CzdS1jWUv5LUoO8LInP1zLIIRX2jmwamIfIOBdix8jvEr6NQLGg2Bp7/ygNb9dbgQ6y0vmlWIA==
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/s3-request-presigner/-/s3-request-presigner-3.465.0.tgz#e54e7f190c277ed53c53c5b6060150d5339e64fc"
+  integrity sha512-wQTddmwGR+5GZR6KLXMejFuTHzuKRcbwgfTrIemYQDt6DDT4fbQGAvnIZnzpHbqnfx1bQEXquM/oB7LZrASiQQ==
   dependencies:
-    "@aws-sdk/signature-v4-multi-region" "3.451.0"
-    "@aws-sdk/types" "3.451.0"
-    "@aws-sdk/util-format-url" "3.451.0"
+    "@aws-sdk/signature-v4-multi-region" "3.465.0"
+    "@aws-sdk/types" "3.465.0"
+    "@aws-sdk/util-format-url" "3.465.0"
     "@smithy/middleware-endpoint" "^2.2.0"
     "@smithy/protocol-http" "^3.0.9"
     "@smithy/smithy-client" "^2.1.15"
     "@smithy/types" "^2.5.0"
     tslib "^2.5.0"
 
-"@aws-sdk/signature-v4-multi-region@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/signature-v4-multi-region/-/signature-v4-multi-region-3.451.0.tgz#d8ec1b653037e3d979e6bb32df05a709ff32938b"
-  integrity sha512-qQKY7/txeNUTLyRL3WxUWEwaZ5sf76EIZgu9kLaR96cAYSxwQi/qQB3ijbfD6u7sJIA8aROMxeYK0VmRsQg0CA==
+"@aws-sdk/signature-v4-multi-region@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/signature-v4-multi-region/-/signature-v4-multi-region-3.465.0.tgz#c4c5b00d5998ea8e2a675cc592a0fb5eaa691147"
+  integrity sha512-p620S4YCr2CPNIdSnRvBqScAqWztjef9EwtD1MAkxTTrjNAyxSCf4apeQ2pdaWNNkJT1vSc/YKBAJ7l2SWn7rw==
   dependencies:
-    "@aws-sdk/types" "3.451.0"
+    "@aws-sdk/middleware-sdk-s3" "3.465.0"
+    "@aws-sdk/types" "3.465.0"
     "@smithy/protocol-http" "^3.0.9"
     "@smithy/signature-v4" "^2.0.0"
     "@smithy/types" "^2.5.0"
     tslib "^2.5.0"
 
-"@aws-sdk/token-providers@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/token-providers/-/token-providers-3.451.0.tgz#fb80e2fa39bb277fb77040a59c88312a115c35bd"
-  integrity sha512-ij1L5iUbn6CwxVOT1PG4NFjsrsKN9c4N1YEM0lkl6DwmaNOscjLKGSNyj9M118vSWsOs1ZDbTwtj++h0O/BWrQ==
+"@aws-sdk/token-providers@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/token-providers/-/token-providers-3.465.0.tgz#e063a30c73878462a5a1542a3eb28ac5e72c5921"
+  integrity sha512-NaZbsyLs3whzRHGV27hrRwEdXB/tEK6tqn/aCNBy862LhVzocY1A+eYLKrnrvpraOOd2vyAuOtvvB3RMIdiL6g==
   dependencies:
     "@aws-crypto/sha256-browser" "3.0.0"
     "@aws-crypto/sha256-js" "3.0.0"
-    "@aws-sdk/middleware-host-header" "3.451.0"
-    "@aws-sdk/middleware-logger" "3.451.0"
-    "@aws-sdk/middleware-recursion-detection" "3.451.0"
-    "@aws-sdk/middleware-user-agent" "3.451.0"
-    "@aws-sdk/region-config-resolver" "3.451.0"
-    "@aws-sdk/types" "3.451.0"
-    "@aws-sdk/util-endpoints" "3.451.0"
-    "@aws-sdk/util-user-agent-browser" "3.451.0"
-    "@aws-sdk/util-user-agent-node" "3.451.0"
+    "@aws-sdk/middleware-host-header" "3.465.0"
+    "@aws-sdk/middleware-logger" "3.465.0"
+    "@aws-sdk/middleware-recursion-detection" "3.465.0"
+    "@aws-sdk/middleware-user-agent" "3.465.0"
+    "@aws-sdk/region-config-resolver" "3.465.0"
+    "@aws-sdk/types" "3.465.0"
+    "@aws-sdk/util-endpoints" "3.465.0"
+    "@aws-sdk/util-user-agent-browser" "3.465.0"
+    "@aws-sdk/util-user-agent-node" "3.465.0"
     "@smithy/config-resolver" "^2.0.18"
     "@smithy/fetch-http-handler" "^2.2.6"
     "@smithy/hash-node" "^2.0.15"
@@ -882,36 +886,36 @@
     "@smithy/util-utf8" "^2.0.2"
     tslib "^2.5.0"
 
-"@aws-sdk/types@3.451.0", "@aws-sdk/types@^3.222.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/types/-/types-3.451.0.tgz#37ab4b25074c6a36152eb36abb7399b3768c2e7b"
-  integrity sha512-rhK+qeYwCIs+laJfWCcrYEjay2FR/9VABZJ2NRM89jV/fKqGVQR52E5DQqrI+oEIL5JHMhhnr4N4fyECMS35lw==
+"@aws-sdk/types@3.465.0", "@aws-sdk/types@^3.222.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/types/-/types-3.465.0.tgz#74977008020f3ed2e5fa0d61daef70d1cbfbfc37"
+  integrity sha512-Clqu2eD50OOzwSftGpzJrIOGev/7VJhJpc02SeS4cqFgI9EVd+rnFKS/Ux0kcwjLQBMiPcCLtql3KAHApFHAIA==
   dependencies:
     "@smithy/types" "^2.5.0"
     tslib "^2.5.0"
 
-"@aws-sdk/util-arn-parser@3.310.0":
-  version "3.310.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/util-arn-parser/-/util-arn-parser-3.310.0.tgz#861ff8810851be52a320ec9e4786f15b5fc74fba"
-  integrity sha512-jL8509owp/xB9+Or0pvn3Fe+b94qfklc2yPowZZIFAkFcCSIdkIglz18cPDWnYAcy9JGewpMS1COXKIUhZkJsA==
+"@aws-sdk/util-arn-parser@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/util-arn-parser/-/util-arn-parser-3.465.0.tgz#2896f6b06f69770378586853c97a0f283cbb2e20"
+  integrity sha512-zOJ82vzDJFqBX9yZBlNeHHrul/kpx/DCoxzW5UBbZeb26kfV53QhMSoEmY8/lEbBqlqargJ/sgRC845GFhHNQw==
   dependencies:
     tslib "^2.5.0"
 
-"@aws-sdk/util-endpoints@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/util-endpoints/-/util-endpoints-3.451.0.tgz#8719977c3535c6fec719a2854ffe037e02412ddb"
-  integrity sha512-giqLGBTnRIcKkDqwU7+GQhKbtJ5Ku35cjGQIfMyOga6pwTBUbaK0xW1Sdd8sBQ1GhApscnChzI9o/R9x0368vw==
+"@aws-sdk/util-endpoints@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/util-endpoints/-/util-endpoints-3.465.0.tgz#b3800364bd856bdfe94e0a1c72979d1bda27a0b8"
+  integrity sha512-lDpBN1faVw8Udg5hIo+LJaNfllbBF86PCisv628vfcggO8/EArL/v2Eos0KeqVT8yaINXCRSagwfo5TNTuW0KQ==
   dependencies:
-    "@aws-sdk/types" "3.451.0"
+    "@aws-sdk/types" "3.465.0"
     "@smithy/util-endpoints" "^1.0.4"
     tslib "^2.5.0"
 
-"@aws-sdk/util-format-url@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/util-format-url/-/util-format-url-3.451.0.tgz#23cc697f02f2160cad327024e512bd78fbfa0dd8"
-  integrity sha512-gmcqSFTIISU9iN6rSbc8HVqB9ACluPbo4mS0ztkk9DaDz5zK/YxoKBJSfqkZFidMzxYiXeWruDCxD8ZgYRn6ug==
+"@aws-sdk/util-format-url@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/util-format-url/-/util-format-url-3.465.0.tgz#fdd30792b788736fdb772e8e1e346bd97d9c595a"
+  integrity sha512-jJmIeMFQMADPw5DfyIzqqsIyS4p+duc1fhnOK+GfEkyja1cjafUQOcvovpQ4rCRHGffjTG2LCkOdyrSRDTFzfQ==
   dependencies:
-    "@aws-sdk/types" "3.451.0"
+    "@aws-sdk/types" "3.465.0"
     "@smithy/querystring-builder" "^2.0.13"
     "@smithy/types" "^2.5.0"
     tslib "^2.5.0"
@@ -923,22 +927,22 @@
   dependencies:
     tslib "^2.5.0"
 
-"@aws-sdk/util-user-agent-browser@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/util-user-agent-browser/-/util-user-agent-browser-3.451.0.tgz#0b511703c3304a5c2fdaa864589246c93ad63dce"
-  integrity sha512-Ws5mG3J0TQifH7OTcMrCTexo7HeSAc3cBgjfhS/ofzPUzVCtsyg0G7I6T7wl7vJJETix2Kst2cpOsxygPgPD9w==
+"@aws-sdk/util-user-agent-browser@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/util-user-agent-browser/-/util-user-agent-browser-3.465.0.tgz#2cb792c48770fe650cbb2b66ac21a8d65b0ca5ba"
+  integrity sha512-RM+LjkIsmUCBJ4yQeBnkJWJTjPOPqcNaKv8bpZxatIHdvzGhXLnWLNi3qHlBsJB2mKtKRet6nAUmKmzZR1sDzA==
   dependencies:
-    "@aws-sdk/types" "3.451.0"
+    "@aws-sdk/types" "3.465.0"
     "@smithy/types" "^2.5.0"
     bowser "^2.11.0"
     tslib "^2.5.0"
 
-"@aws-sdk/util-user-agent-node@3.451.0":
-  version "3.451.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/util-user-agent-node/-/util-user-agent-node-3.451.0.tgz#f2af3f0d3f0389a14a7dbbc835dc94c705c0a39a"
-  integrity sha512-TBzm6P+ql4mkGFAjPlO1CI+w3yUT+NulaiALjl/jNX/nnUp6HsJsVxJf4nVFQTG5KRV0iqMypcs7I3KIhH+LmA==
+"@aws-sdk/util-user-agent-node@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/util-user-agent-node/-/util-user-agent-node-3.465.0.tgz#5838e93a0f2102fb555131f40bd454707caba3f9"
+  integrity sha512-XsHbq7gLCiGdy6FQ7/5nGslK0ij3Iuh051djuIICvNurlds5cqKLiBe63gX3IUUwxJcrKh4xBGviQJ52KdVSeg==
   dependencies:
-    "@aws-sdk/types" "3.451.0"
+    "@aws-sdk/types" "3.465.0"
     "@smithy/node-config-provider" "^2.1.5"
     "@smithy/types" "^2.5.0"
     tslib "^2.5.0"
@@ -950,10 +954,10 @@
   dependencies:
     tslib "^2.3.1"
 
-"@aws-sdk/xml-builder@3.310.0":
-  version "3.310.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/xml-builder/-/xml-builder-3.310.0.tgz#f0236f2103b438d16117e0939a6305ad69b7ff76"
-  integrity sha512-TqELu4mOuSIKQCqj63fGVs86Yh+vBx5nHRpWKNUNhB2nPTpfbziTs5c1X358be3peVWA4wPxW7Nt53KIg1tnNw==
+"@aws-sdk/xml-builder@3.465.0":
+  version "3.465.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/xml-builder/-/xml-builder-3.465.0.tgz#0914bc0b9708848f1fa509dd6e474e8c691a0cb2"
+  integrity sha512-9TKW5ZgsReygePTnAUdvaqxr/k1HXsEz2yDnk/jTLaUeRPsd5la8fFjb6OfgYYlbEVNlxTcKzaqOdrqxpUkmyQ==
   dependencies:
     tslib "^2.5.0"
 
@@ -964,12 +968,12 @@
   dependencies:
     "@babel/highlight" "^7.10.4"
 
-"@babel/code-frame@^7.0.0", "@babel/code-frame@^7.16.0", "@babel/code-frame@^7.22.13":
-  version "7.22.13"
-  resolved "https://registry.yarnpkg.com/@babel/code-frame/-/code-frame-7.22.13.tgz#e3c1c099402598483b7a8c46a721d1038803755e"
-  integrity sha512-XktuhWlJ5g+3TJXc5upd9Ks1HutSArik6jf2eAjYFyIOf4ej3RN+184cZbzDvbPnuTJIUhPKKJE3cIsYTiAT3w==
+"@babel/code-frame@^7.0.0", "@babel/code-frame@^7.16.0", "@babel/code-frame@^7.22.13", "@babel/code-frame@^7.23.5":
+  version "7.23.5"
+  resolved "https://registry.yarnpkg.com/@babel/code-frame/-/code-frame-7.23.5.tgz#9009b69a8c602293476ad598ff53e4562e15c244"
+  integrity sha512-CgH3s1a96LipHCmSUmYFPwY7MNx8C3avkq7i4Wl3cfa662ldtUe4VM1TPXX70pfmrlWTb6jLqTYrZyT2ZTJBgA==
   dependencies:
-    "@babel/highlight" "^7.22.13"
+    "@babel/highlight" "^7.23.4"
     chalk "^2.4.2"
 
 "@babel/compat-data@^7.17.7", "@babel/compat-data@^7.18.8", "@babel/compat-data@^7.19.3":
@@ -983,32 +987,32 @@
   integrity sha512-5UamI7xkUcJ3i9qVDS+KFDEK8/7oJ55/sJMB1Ge7IEapr7KfdfV/HErR+koZwOfd+SgtFKOKRhRakdg++DcJpQ==
 
 "@babel/core@^7.1.6", "@babel/core@^7.10.3", "@babel/core@^7.12.16", "@babel/core@^7.12.3", "@babel/core@^7.18.13", "@babel/core@^7.7.5":
-  version "7.23.3"
-  resolved "https://registry.yarnpkg.com/@babel/core/-/core-7.23.3.tgz#5ec09c8803b91f51cc887dedc2654a35852849c9"
-  integrity sha512-Jg+msLuNuCJDyBvFv5+OKOUjWMZgd85bKjbICd3zWrKAo+bJ49HJufi7CQE0q0uR8NGyO6xkCACScNqyjHSZew==
+  version "7.23.5"
+  resolved "https://registry.yarnpkg.com/@babel/core/-/core-7.23.5.tgz#6e23f2acbcb77ad283c5ed141f824fd9f70101c7"
+  integrity sha512-Cwc2XjUrG4ilcfOw4wBAK+enbdgwAcAJCfGUItPBKR7Mjw4aEfAFYrLxeRp4jWgtNIKn3n2AlBOfwwafl+42/g==
   dependencies:
     "@ampproject/remapping" "^2.2.0"
-    "@babel/code-frame" "^7.22.13"
-    "@babel/generator" "^7.23.3"
+    "@babel/code-frame" "^7.23.5"
+    "@babel/generator" "^7.23.5"
     "@babel/helper-compilation-targets" "^7.22.15"
     "@babel/helper-module-transforms" "^7.23.3"
-    "@babel/helpers" "^7.23.2"
-    "@babel/parser" "^7.23.3"
+    "@babel/helpers" "^7.23.5"
+    "@babel/parser" "^7.23.5"
     "@babel/template" "^7.22.15"
-    "@babel/traverse" "^7.23.3"
-    "@babel/types" "^7.23.3"
+    "@babel/traverse" "^7.23.5"
+    "@babel/types" "^7.23.5"
     convert-source-map "^2.0.0"
     debug "^4.1.0"
     gensync "^1.0.0-beta.2"
     json5 "^2.2.3"
     semver "^6.3.1"
 
-"@babel/generator@^7.23.3":
-  version "7.23.3"
-  resolved "https://registry.yarnpkg.com/@babel/generator/-/generator-7.23.3.tgz#86e6e83d95903fbe7613f448613b8b319f330a8e"
-  integrity sha512-keeZWAV4LU3tW0qRi19HRpabC/ilM0HRBBzf9/k8FFiG4KVpiv0FIy4hHfLfFQZNhziCTPTmd59zoyv6DNISzg==
+"@babel/generator@^7.23.5":
+  version "7.23.5"
+  resolved "https://registry.yarnpkg.com/@babel/generator/-/generator-7.23.5.tgz#17d0a1ea6b62f351d281350a5f80b87a810c4755"
+  integrity sha512-BPssCHrBD+0YrxviOa3QzpqwhNIXKEtOa2jQrm4FlmkC2apYgRnQcmPWiGZDlGxiNtltnUFolMe8497Esry+jA==
   dependencies:
-    "@babel/types" "^7.23.3"
+    "@babel/types" "^7.23.5"
     "@jridgewell/gen-mapping" "^0.3.2"
     "@jridgewell/trace-mapping" "^0.3.17"
     jsesc "^2.5.1"
@@ -1219,10 +1223,10 @@
   dependencies:
     "@babel/types" "^7.22.5"
 
-"@babel/helper-string-parser@^7.22.5":
-  version "7.22.5"
-  resolved "https://registry.yarnpkg.com/@babel/helper-string-parser/-/helper-string-parser-7.22.5.tgz#533f36457a25814cf1df6488523ad547d784a99f"
-  integrity sha512-mM4COjgZox8U+JcXQwPijIZLElkgEpO5rsERVDJTc2qfCDfERyob6k5WegS14SX18IIjv+XD+GrqNumY5JRCDw==
+"@babel/helper-string-parser@^7.23.4":
+  version "7.23.4"
+  resolved "https://registry.yarnpkg.com/@babel/helper-string-parser/-/helper-string-parser-7.23.4.tgz#9478c707febcbbe1ddb38a3d91a2e054ae622d83"
+  integrity sha512-803gmbQdqwdf4olxrX4AJyFBV/RTr3rSmOj0rKwesmzlfhYNDEs+/iOcznzpNWlJlIlTJC2QfPFcHB6DlzdVLQ==
 
 "@babel/helper-validator-identifier@^7.18.6":
   version "7.19.1"
@@ -1234,11 +1238,6 @@
   resolved "https://registry.yarnpkg.com/@babel/helper-validator-identifier/-/helper-validator-identifier-7.22.20.tgz#c4ae002c61d2879e724581d96665583dbc1dc0e0"
   integrity sha512-Y4OZ+ytlatR8AI+8KZfKuL5urKp7qey08ha31L8b3BwewJAoJamTzyvxPR/5D+KkdJCGPq/+8TukHBlY10FX9A==
 
-"@babel/helper-validator-identifier@^7.22.5":
-  version "7.22.5"
-  resolved "https://registry.yarnpkg.com/@babel/helper-validator-identifier/-/helper-validator-identifier-7.22.5.tgz#9544ef6a33999343c8740fa51350f30eeaaaf193"
-  integrity sha512-aJXu+6lErq8ltp+JhkJUfk1MTGyuA4v7f3pA+BJ5HLfNC6nAQ0Cpi9uOquUj8Hehg0aUiHzWQbOVJGao6ztBAQ==
-
 "@babel/helper-validator-option@^7.18.6":
   version "7.18.6"
   resolved "https://registry.yarnpkg.com/@babel/helper-validator-option/-/helper-validator-option-7.18.6.tgz#bf0d2b5a509b1f336099e4ff36e1a63aa5db4db8"
@@ -1259,14 +1258,14 @@
     "@babel/traverse" "^7.19.0"
     "@babel/types" "^7.19.0"
 
-"@babel/helpers@^7.23.2":
-  version "7.23.2"
-  resolved "https://registry.yarnpkg.com/@babel/helpers/-/helpers-7.23.2.tgz#2832549a6e37d484286e15ba36a5330483cac767"
-  integrity sha512-lzchcp8SjTSVe/fPmLwtWVBFC7+Tbn8LGHDVfDp9JGxpAY5opSaEFgt8UQvrnECWOTdji2mOWMz1rOhkHscmGQ==
+"@babel/helpers@^7.23.5":
+  version "7.23.5"
+  resolved "https://registry.yarnpkg.com/@babel/helpers/-/helpers-7.23.5.tgz#52f522840df8f1a848d06ea6a79b79eefa72401e"
+  integrity sha512-oO7us8FzTEsG3U6ag9MfdF1iA/7Z6dz+MtFhifZk8C8o453rGJFFWUP1t+ULM9TUIAzC9uxXEiXjOiVMyd7QPg==
   dependencies:
     "@babel/template" "^7.22.15"
-    "@babel/traverse" "^7.23.2"
-    "@babel/types" "^7.23.0"
+    "@babel/traverse" "^7.23.5"
+    "@babel/types" "^7.23.5"
 
 "@babel/highlight@^7.10.4":
   version "7.18.6"
@@ -1277,19 +1276,19 @@
     chalk "^2.0.0"
     js-tokens "^4.0.0"
 
-"@babel/highlight@^7.22.13":
-  version "7.22.13"
-  resolved "https://registry.yarnpkg.com/@babel/highlight/-/highlight-7.22.13.tgz#9cda839e5d3be9ca9e8c26b6dd69e7548f0cbf16"
-  integrity sha512-C/BaXcnnvBCmHTpz/VGZ8jgtE2aYlW4hxDhseJAWZb7gqGM/qtCK6iZUb0TyKFf7BOUsBH7Q7fkRsDRhg1XklQ==
+"@babel/highlight@^7.23.4":
+  version "7.23.4"
+  resolved "https://registry.yarnpkg.com/@babel/highlight/-/highlight-7.23.4.tgz#edaadf4d8232e1a961432db785091207ead0621b"
+  integrity sha512-acGdbYSfp2WheJoJm/EBBBLh/ID8KDc64ISZ9DYtBmC8/Q204PZJLHyzeB5qMzJ5trcOkybd78M4x2KWsUq++A==
   dependencies:
-    "@babel/helper-validator-identifier" "^7.22.5"
+    "@babel/helper-validator-identifier" "^7.22.20"
     chalk "^2.4.2"
     js-tokens "^4.0.0"
 
-"@babel/parser@^7.1.6", "@babel/parser@^7.14.7", "@babel/parser@^7.16.4", "@babel/parser@^7.18.4", "@babel/parser@^7.22.15", "@babel/parser@^7.23.3", "@babel/parser@^7.7.0":
-  version "7.23.3"
-  resolved "https://registry.yarnpkg.com/@babel/parser/-/parser-7.23.3.tgz#0ce0be31a4ca4f1884b5786057cadcb6c3be58f9"
-  integrity sha512-uVsWNvlVsIninV2prNz/3lHCb+5CJ+e+IUBfbjToAHODtfGYLfCFuY4AU7TskI+dAKk+njsPiBjq1gKTvZOBaw==
+"@babel/parser@^7.1.6", "@babel/parser@^7.14.7", "@babel/parser@^7.16.4", "@babel/parser@^7.18.4", "@babel/parser@^7.22.15", "@babel/parser@^7.23.5", "@babel/parser@^7.7.0":
+  version "7.23.5"
+  resolved "https://registry.yarnpkg.com/@babel/parser/-/parser-7.23.5.tgz#37dee97c4752af148e1d38c34b856b2507660563"
+  integrity sha512-hOOqoiNXrmGdFbhgCzu6GiURxUgM27Xwd/aPuu8RfHEZPBzL1Z54okAHAQjXfcQNwvrlkAmAp4SlRTZ45vlthQ==
 
 "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression@^7.18.6":
   version "7.18.6"
@@ -2007,28 +2006,28 @@
     "@babel/parser" "^7.22.15"
     "@babel/types" "^7.22.15"
 
-"@babel/traverse@^7.0.0", "@babel/traverse@^7.19.0", "@babel/traverse@^7.19.1", "@babel/traverse@^7.23.2", "@babel/traverse@^7.23.3", "@babel/traverse@^7.7.0":
-  version "7.23.3"
-  resolved "https://registry.yarnpkg.com/@babel/traverse/-/traverse-7.23.3.tgz#26ee5f252e725aa7aca3474aa5b324eaf7908b5b"
-  integrity sha512-+K0yF1/9yR0oHdE0StHuEj3uTPzwwbrLGfNOndVJVV2TqA5+j3oljJUb4nmB954FLGjNem976+B+eDuLIjesiQ==
+"@babel/traverse@^7.0.0", "@babel/traverse@^7.19.0", "@babel/traverse@^7.19.1", "@babel/traverse@^7.23.5", "@babel/traverse@^7.7.0":
+  version "7.23.5"
+  resolved "https://registry.yarnpkg.com/@babel/traverse/-/traverse-7.23.5.tgz#f546bf9aba9ef2b042c0e00d245990c15508e7ec"
+  integrity sha512-czx7Xy5a6sapWWRx61m1Ke1Ra4vczu1mCTtJam5zRTBOonfdJ+S/B6HYmGYu3fJtr8GGET3si6IhgWVBhJ/m8w==
   dependencies:
-    "@babel/code-frame" "^7.22.13"
-    "@babel/generator" "^7.23.3"
+    "@babel/code-frame" "^7.23.5"
+    "@babel/generator" "^7.23.5"
     "@babel/helper-environment-visitor" "^7.22.20"
     "@babel/helper-function-name" "^7.23.0"
     "@babel/helper-hoist-variables" "^7.22.5"
     "@babel/helper-split-export-declaration" "^7.22.6"
-    "@babel/parser" "^7.23.3"
-    "@babel/types" "^7.23.3"
+    "@babel/parser" "^7.23.5"
+    "@babel/types" "^7.23.5"
     debug "^4.1.0"
     globals "^11.1.0"
 
-"@babel/types@^7.0.0", "@babel/types@^7.12.12", "@babel/types@^7.18.6", "@babel/types@^7.18.9", "@babel/types@^7.19.0", "@babel/types@^7.19.3", "@babel/types@^7.22.15", "@babel/types@^7.22.5", "@babel/types@^7.23.0", "@babel/types@^7.23.3", "@babel/types@^7.4.4", "@babel/types@^7.7.0":
-  version "7.23.3"
-  resolved "https://registry.yarnpkg.com/@babel/types/-/types-7.23.3.tgz#d5ea892c07f2ec371ac704420f4dcdb07b5f9598"
-  integrity sha512-OZnvoH2l8PK5eUvEcUyCt/sXgr/h+UWpVuBbOljwcrAgUl6lpchoQ++PHGyQy1AtYnVA6CEq3y5xeEI10brpXw==
+"@babel/types@^7.0.0", "@babel/types@^7.12.12", "@babel/types@^7.18.6", "@babel/types@^7.18.9", "@babel/types@^7.19.0", "@babel/types@^7.19.3", "@babel/types@^7.22.15", "@babel/types@^7.22.5", "@babel/types@^7.23.0", "@babel/types@^7.23.5", "@babel/types@^7.4.4", "@babel/types@^7.7.0":
+  version "7.23.5"
+  resolved "https://registry.yarnpkg.com/@babel/types/-/types-7.23.5.tgz#48d730a00c95109fa4393352705954d74fb5b602"
+  integrity sha512-ON5kSOJwVO6xXVRTvOI0eOnWe7VdUcIpsovGo9U/Br4Ie4UVFQTboO2cYnDhAGU6Fp+UxSiT+pMft0SMHfuq6w==
   dependencies:
-    "@babel/helper-string-parser" "^7.22.5"
+    "@babel/helper-string-parser" "^7.23.4"
     "@babel/helper-validator-identifier" "^7.22.20"
     to-fast-properties "^2.0.0"