feat(app): Adds abra app move command

See toolshed/organising#461

.envrc.sample

@@ -1,6 +1,6 @@
 # integration test suite
 # export ABRA_DIR="$HOME/.abra_test"
-# export ABRA_TEST_DOMAIN=test.example.com
+# export TEST_SERVER=test.example.com
 # export ABRA_CI=1
 
 # release automation

cli/app/app.go

@@ -1,11 +1,12 @@
 package app
 
 import (
+	"github.com/leonelquinteros/gotext"
 	"github.com/spf13/cobra"
 )
 
 var AppCommand = &cobra.Command{
 	Use:     "app [cmd] [args] [flags]",
 	Aliases: []string{"a"},
-	Short:   "Manage apps",
+	Short:   gotext.Get("Manage apps"),
 }

cli/app/cmd.go

@@ -183,7 +183,7 @@ does not).`,
 		if err := internal.RunCmdRemote(
 			cl,
 			app,
-			requestTTY,
+			disableTTY,
 			app.Recipe.AbraShPath,
 			targetServiceName, cmdName, parsedCmdArgs, remoteUser); err != nil {
 			log.Fatal(err)
@@ -238,7 +238,7 @@ func parseCmdArgs(args []string, isLocal bool) (bool, string) {
 var (
 	local      bool
 	remoteUser string
-	requestTTY bool
+	disableTTY bool
 )
 
 func init() {
@@ -259,11 +259,11 @@ func init() {
 	)
 
 	AppCmdCommand.Flags().BoolVarP(
-		&requestTTY,
+		&disableTTY,
 		"tty",
 		"T",
 		false,
-		"request remote TTY",
+		"disable remote TTY",
 	)
 
 	AppCmdCommand.Flags().BoolVarP(

cli/app/cp.go

@@ -33,7 +33,7 @@ var AppCpCommand = &cobra.Command{
   abra app cp 1312.net myfile.txt app:/
 
   # copy that file back to your current working directory locally
-  abra app cp 1312.net app:/myfile.txt`,
+  abra app cp 1312.net app:/myfile.txt ./`,
 	Args: cobra.ExactArgs(3),
 	ValidArgsFunction: func(
 		cmd *cobra.Command,

cli/app/deploy.go

@@ -108,7 +108,11 @@ checkout as-is. Recipe commit hashes are also supported as values for
 		}
 
 		if err := lint.LintForErrors(app.Recipe); err != nil {
-			log.Fatal(err)
+			if internal.Chaos {
+				log.Warn(err)
+			} else {
+				log.Fatal(err)
+			}
 		}
 
 		if err := validateSecrets(cl, app); err != nil {
@@ -197,7 +201,25 @@ checkout as-is. Recipe commit hashes are also supported as values for
 
 		log.Debugf("set waiting timeout to %d second(s)", stack.WaitTimeout)
 
-		if err := stack.RunDeploy(cl, deployOpts, compose, app.Name, internal.DontWaitConverge); err != nil {
+		serviceNames, err := appPkg.GetAppServiceNames(app.Name)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		f, err := app.Filters(true, false, serviceNames...)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		if err := stack.RunDeploy(
+			cl,
+			deployOpts,
+			compose,
+			app.Name,
+			app.Server,
+			internal.DontWaitConverge,
+			f,
+		); err != nil {
 			log.Fatal(err)
 		}
 

cli/app/list.go

@@ -142,10 +142,14 @@ Use "--status/-S" flag to query all servers for the live deployment status.`,
 					appStats.AutoUpdate = autoUpdate
 
 					var newUpdates []string
-					if version != "unknown" {
+					if version != "unknown" && chaos == "false" {
+						if err := app.Recipe.EnsureExists(); err != nil {
+							log.Fatalf("unable to clone %s: %s", app.Name, err)
+						}
+
 						updates, err := app.Recipe.Tags()
 						if err != nil {
-							log.Fatal(err)
+							log.Fatalf("unable to retrieve tags for %s: %s", app.Name, err)
 						}
 
 						parsedVersion, err := tagcmp.Parse(version)

cli/app/logs.go

@@ -3,23 +3,14 @@ package app
 import (
 	"context"
 	"fmt"
-	"io"
-	"os"
-	"slices"
-	"sync"
-	"time"
 
 	"coopcloud.tech/abra/cli/internal"
 	appPkg "coopcloud.tech/abra/pkg/app"
 	"coopcloud.tech/abra/pkg/autocomplete"
 	"coopcloud.tech/abra/pkg/client"
 	"coopcloud.tech/abra/pkg/log"
+	"coopcloud.tech/abra/pkg/logs"
 	"coopcloud.tech/abra/pkg/upstream/stack"
-	"github.com/docker/docker/api/types"
-	containerTypes "github.com/docker/docker/api/types/container"
-	"github.com/docker/docker/api/types/filters"
-	"github.com/docker/docker/api/types/swarm"
-	dockerClient "github.com/docker/docker/client"
 	"github.com/spf13/cobra"
 )
 
@@ -73,80 +64,25 @@ var AppLogsCommand = &cobra.Command{
 			serviceNames = []string{args[1]}
 		}
 
-		if err = tailLogs(cl, app, serviceNames); err != nil {
+		f, err := app.Filters(true, false, serviceNames...)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		opts := logs.TailOpts{
+			AppName:  app.Name,
+			Services: serviceNames,
+			StdErr:   stdErr,
+			Since:    sinceLogs,
+			Filters:  f,
+		}
+
+		if err := logs.TailLogs(cl, opts); err != nil {
 			log.Fatal(err)
 		}
 	},
 }
 
-// tailLogs prints logs for the given app with optional service names to be
-// filtered on. It also checks if the latest task is not runnning and then
-// prints the past tasks.
-func tailLogs(cl *dockerClient.Client, app appPkg.App, serviceNames []string) error {
-	f, err := app.Filters(true, false, serviceNames...)
-	if err != nil {
-		return err
-	}
-
-	services, err := cl.ServiceList(context.Background(), types.ServiceListOptions{Filters: f})
-	if err != nil {
-		return err
-	}
-
-	var wg sync.WaitGroup
-	for _, service := range services {
-		filters := filters.NewArgs()
-		filters.Add("name", service.Spec.Name)
-		tasks, err := cl.TaskList(context.Background(), types.TaskListOptions{Filters: f})
-		if err != nil {
-			return err
-		}
-		if len(tasks) > 0 {
-			// Need to sort the tasks by the CreatedAt field in the inverse order.
-			// Otherwise they are in the reversed order and not sorted properly.
-			slices.SortFunc[[]swarm.Task](tasks, func(t1, t2 swarm.Task) int {
-				return int(t2.Meta.CreatedAt.Unix() - t1.Meta.CreatedAt.Unix())
-			})
-			lastTask := tasks[0].Status
-			if lastTask.State != swarm.TaskStateRunning {
-				for _, task := range tasks {
-					log.Errorf("[%s] %s State %s: %s", service.Spec.Name, task.Meta.CreatedAt.Format(time.RFC3339), task.Status.State, task.Status.Err)
-				}
-			}
-		}
-
-		// Collect the logs in a go routine, so the logs from all services are
-		// collected in parallel.
-		wg.Add(1)
-		go func(serviceID string) {
-			logs, err := cl.ServiceLogs(context.Background(), serviceID, containerTypes.LogsOptions{
-				ShowStderr: true,
-				ShowStdout: !stdErr,
-				Since:      sinceLogs,
-				Until:      "",
-				Timestamps: true,
-				Follow:     true,
-				Tail:       "20",
-				Details:    false,
-			})
-			if err != nil {
-				log.Fatal(err)
-			}
-			defer logs.Close()
-
-			_, err = io.Copy(os.Stdout, logs)
-			if err != nil && err != io.EOF {
-				log.Fatal(err)
-			}
-		}(service.ID)
-	}
-
-	// Wait for all log streams to be closed.
-	wg.Wait()
-
-	return nil
-}
-
 var (
 	stdErr    bool
 	sinceLogs string

cli/app/move.go

@@ -0,0 +1,313 @@
+package app
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+
+	"coopcloud.tech/abra/cli/internal"
+	"coopcloud.tech/abra/pkg/app"
+	appPkg "coopcloud.tech/abra/pkg/app"
+	"coopcloud.tech/abra/pkg/autocomplete"
+	"coopcloud.tech/abra/pkg/client"
+	containerPkg "coopcloud.tech/abra/pkg/container"
+	"coopcloud.tech/abra/pkg/log"
+	"coopcloud.tech/abra/pkg/secret"
+	"coopcloud.tech/abra/pkg/upstream/stack"
+	"github.com/docker/docker/api/types"
+	containertypes "github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/filters"
+	"github.com/docker/docker/api/types/mount"
+	"github.com/docker/docker/api/types/swarm"
+	"github.com/docker/docker/api/types/volume"
+	dockerclient "github.com/docker/docker/client"
+	"github.com/spf13/cobra"
+)
+
+var AppMoveCommand = &cobra.Command{
+	Use:   "move <domain> <server> [flags]",
+	Short: "Moves an app to a different server",
+	Long: `Move an app to a differnt server.
+
+This will copy secrets and volumes from the old server to the new one. It will also undeploy the app from old server but not deploy it on the new. You will have to do that your self, after the move finished.
+
+Use "--dry-run/-r" to see which secrets and volumes will be moved.`,
+	Example: `  # moving an app
+  abra app move nextcloud.example.com myserver.com`,
+	Args: cobra.RangeArgs(1, 2),
+	ValidArgsFunction: func(
+		cmd *cobra.Command,
+		args []string,
+		toComplete string,
+	) ([]string, cobra.ShellCompDirective) {
+		switch l := len(args); l {
+		case 0:
+			return autocomplete.AppNameComplete()
+		case 1:
+			return autocomplete.ServerNameComplete()
+		default:
+			return nil, cobra.ShellCompDirectiveDefault
+		}
+	},
+	Run: func(cmd *cobra.Command, args []string) {
+		app := internal.ValidateApp(args)
+		if len(args) <= 1 {
+			log.Fatal("no server provided")
+		}
+		newServer := args[1]
+
+		if err := app.Recipe.Ensure(internal.GetEnsureContext()); err != nil {
+			log.Fatal(err)
+		}
+
+		cl, err := client.New(app.Server)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		resources, err := getAppResources(cl, app)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		internal.MoveOverview(app, newServer, resources.SecretNames(), resources.VolumeNames())
+		if err := internal.PromptProcced(); err != nil {
+			return
+		}
+
+		// NOTE: wait timeout will be removed, until it actually is just set it to a high value.
+		stack.WaitTimeout = 500
+		rmOpts := stack.Remove{
+			Namespaces: []string{app.StackName()},
+			Detach:     false,
+		}
+		if err := stack.RunRemove(context.Background(), cl, rmOpts); err != nil {
+			log.Fatal(err)
+		}
+
+		cl2, err := client.New(newServer)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		for _, s := range resources.SecretList {
+			sname := strings.Split(strings.TrimPrefix(s.Spec.Name, app.StackName()+"_"), "_")
+			secretName := strings.Join(sname[:len(sname)-1], "_")
+			data := resources.Secrets[secretName]
+			if err := client.StoreSecret(cl2, s.Spec.Name, data); err != nil {
+				log.Infof("creating secret: %s", s.Spec.Name)
+				log.Errorf("failed to store secret on new server: %s", err)
+			}
+		}
+
+		for _, v := range resources.Volumes {
+			log.Infof("moving volume: %s", v.Name)
+
+			// Need to create the volume before copying the data, because when
+			// docker creates a new volume it set the folder permissions to
+			// root, which might be wrong. This ensures we always have the
+			// correct folder permissions inside the volume.
+			log.Debug("creating volume: %s", v.Name)
+			_, err := cl2.VolumeCreate(context.Background(), volume.CreateOptions{
+				Name:   v.Name,
+				Driver: v.Driver,
+			})
+			if err != nil {
+				log.Errorf("failed to create volume: %s", err)
+			}
+
+			fileName := fmt.Sprintf("%s.tar.gz", v.Name)
+			log.Debug("creating %s", fileName)
+			cmd := exec.Command("ssh", app.Server, "-tt", fmt.Sprintf("sudo tar --same-owner -czhpf %s -C /var/lib/docker/volumes %s", fileName, v.Name))
+			if out, err := cmd.CombinedOutput(); err != nil {
+				log.Errorf("failed to tar volume: %s", err)
+				fmt.Println(string(out))
+			}
+			log.Debug("copying %s to local machine", fileName)
+			cmd = exec.Command("scp", fmt.Sprintf("%s:%s", app.Server, fileName), fileName)
+			if out, err := cmd.CombinedOutput(); err != nil {
+				log.Errorf("failed to copy tar to local machine: %s", err)
+				fmt.Println(string(out))
+			}
+			log.Debug("copying %s to %s", fileName, newServer)
+			cmd = exec.Command("scp", fileName, fmt.Sprintf("%s:%s", newServer, fileName))
+			if out, err := cmd.CombinedOutput(); err != nil {
+				log.Errorf("failed to copy tar to new server: %s", err)
+				fmt.Println(string(out))
+			}
+			log.Debug("extracting %s on %s", fileName, newServer)
+			cmd = exec.Command("ssh", newServer, "-tt", fmt.Sprintf("sudo tar --same-owner -xzpf %s -C /var/lib/docker/volumes", fileName))
+			if out, err := cmd.CombinedOutput(); err != nil {
+				log.Errorf("failed to extract tar: %s", err)
+				fmt.Println(string(out))
+			}
+
+			// Remove tar files
+			cmd = exec.Command("ssh", newServer, "-tt", fmt.Sprintf("sudo rm %s", fileName))
+			if out, err := cmd.CombinedOutput(); err != nil {
+				log.Errorf("failed to remove tar from new server: %s", err)
+				fmt.Println(string(out))
+			}
+			cmd = exec.Command("ssh", app.Server, "-tt", fmt.Sprintf("sudo rm %s", fileName))
+			if out, err := cmd.CombinedOutput(); err != nil {
+				log.Errorf("failed to remove tar from old server: %s", err)
+				fmt.Println(string(out))
+			}
+			cmd = exec.Command("rm", fileName)
+			if out, err := cmd.CombinedOutput(); err != nil {
+				log.Errorf("failed to remove tar on local machine: %s", err)
+				fmt.Println(string(out))
+			}
+		}
+
+		log.Debug("moving app config to new server")
+		if err := copyFile(app.Path, strings.ReplaceAll(app.Path, app.Server, newServer)); err != nil {
+			log.Fatal(err)
+		}
+		if err := os.Remove(app.Path); err != nil {
+			log.Fatal(err)
+		}
+
+		fmt.Println("% was succefully moved to %s", app.Name, newServer)
+		fmt.Println("Run the following command to deploy the app", app.Name, newServer)
+		fmt.Println("  abra app deploy --no-domain-checks", app.Domain)
+		fmt.Println()
+		fmt.Println("And don't forget to update you DNS record. And don't panic, as it might take a bit for the dust to settle. Traefik for example might fail to obtain the lets encrypt certificate for a while.", app.Domain)
+		fmt.Println()
+		fmt.Println("If anything goes wrong, you can always move the app config file to the original server and deploy it there again. There was no data removed on the old server")
+		return
+	},
+}
+
+type AppResources struct {
+	Secrets    map[string]string
+	SecretList []swarm.Secret
+	Volumes    map[string]containertypes.MountPoint
+}
+
+func (a *AppResources) SecretNames() []string {
+	secrets := []string{}
+	for name := range a.Secrets {
+		secrets = append(secrets, name)
+	}
+	return secrets
+}
+
+func (a *AppResources) VolumeNames() []string {
+	volumes := []string{}
+	for name := range a.Volumes {
+		volumes = append(volumes, name)
+	}
+	return volumes
+}
+
+func getAppResources(cl *dockerclient.Client, app app.App) (*AppResources, error) {
+	filter, err := app.Filters(false, false)
+	if err != nil {
+		return nil, err
+	}
+
+	services, err := cl.ServiceList(context.Background(), types.ServiceListOptions{Filters: filter})
+	if err != nil {
+		return nil, err
+	}
+
+	composeFiles, err := app.Recipe.GetComposeFiles(app.Env)
+	if err != nil {
+		return nil, err
+	}
+
+	secretList, err := cl.SecretList(context.Background(), types.SecretListOptions{Filters: filter})
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	secretConfigs, err := secret.ReadSecretsConfig(app.Path, composeFiles, app.StackName())
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	opts := stack.Deploy{Composefiles: composeFiles, Namespace: app.StackName()}
+	compose, err := appPkg.GetAppComposeConfig(app.Name, opts, app.Env)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	resources := &AppResources{
+		Secrets:    make(map[string]string),
+		SecretList: secretList,
+		Volumes:    make(map[string]containertypes.MountPoint),
+	}
+	for _, s := range services {
+		secretNames := map[string]string{}
+		for _, serviceCompose := range compose.Services {
+			if app.StackName()+"_"+serviceCompose.Name != s.Spec.Name {
+				continue
+			}
+
+			for _, secret := range serviceCompose.Secrets {
+				for _, s := range secretList {
+					if s.Spec.Name == app.StackName()+"_"+secret.Source+"_"+secretConfigs[secret.Source].Version {
+						secretNames[secret.Source] = s.ID
+						break
+					}
+				}
+			}
+		}
+
+		f := filters.NewArgs()
+		f.Add("name", s.Spec.Name)
+		targetContainer, err := containerPkg.GetContainer(context.Background(), cl, f, true)
+		if err != nil {
+			log.Error(err)
+			continue
+		}
+		for _, m := range targetContainer.Mounts {
+			if m.Type == mount.TypeVolume {
+				resources.Volumes[m.Name] = m
+			}
+		}
+
+		for secretName, secretID := range secretNames {
+			if _, ok := resources.Secrets[secretName]; ok {
+				continue
+			}
+			log.Debugf("extracting secret %s", secretName)
+
+			out, err := exec.Command("ssh", app.Server, "-tt", fmt.Sprintf("sudo cat /var/lib/docker/containers/%s/mounts/secrets/%s", targetContainer.ID, secretID)).Output()
+			if err != nil {
+				fmt.Println(string(out))
+				fmt.Println(err)
+				continue
+			}
+			resources.Secrets[secretName] = string(out)
+		}
+	}
+	return resources, nil
+}
+
+func copyFile(src string, dst string) error {
+	// Read all content of src to data, may cause OOM for a large file.
+	data, err := os.ReadFile(src)
+	if err != nil {
+		return err
+	}
+	// Write data to dst
+	err = os.WriteFile(dst, data, 0o644)
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func init() {
+	AppMoveCommand.Flags().BoolVarP(
+		&internal.Dry,
+		"dry-run",
+		"r",
+		false,
+		"report changes that would be made",
+	)
+}

cli/app/new.go

@@ -109,6 +109,15 @@ var AppNewCommand = &cobra.Command{
 				if err := recipe.EnsureLatest(); err != nil {
 					log.Fatal(err)
 				}
+
+				if recipeVersion == "" {
+					head, err := recipe.Head()
+					if err != nil {
+						log.Fatalf("failed to retrieve latest commit for %s: %s", recipe.Name, err)
+					}
+
+					recipeVersion = formatter.SmallSHA(head.String())
+				}
 			}
 		}
 
@@ -185,7 +194,7 @@ var AppNewCommand = &cobra.Command{
 			newAppServer = "local"
 		}
 
-		log.Infof("%s created successfully (version: %s, chaos: %s)", appDomain, recipeVersion, chaosVersion)
+		log.Infof("%s created (version: %s)", appDomain, recipeVersion)
 
 		if len(appSecrets) > 0 {
 			rows := [][]string{}
@@ -293,6 +302,12 @@ func ensureServerFlag() error {
 		return err
 	}
 
+	if len(servers) == 1 {
+		newAppServer = servers[0]
+		log.Infof("single server detected, choosing %s automatically", newAppServer)
+		return nil
+	}
+
 	if newAppServer == "" && !internal.NoInput {
 		prompt := &survey.Select{
 			Message: "Select app server:",

cli/app/ps.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"sort"
 	"strings"
 
 	"coopcloud.tech/abra/cli/internal"
@@ -91,9 +92,14 @@ func showPSOutput(app appPkg.App, cl *dockerClient.Client, deployedVersion, chao
 		return
 	}
 
+	services := compose.Services
+	sort.Slice(services, func(i, j int) bool {
+		return services[i].Name < services[j].Name
+	})
+
 	var rows [][]string
 	allContainerStats := make(map[string]map[string]string)
-	for _, service := range compose.Services {
+	for _, service := range services {
 		filters := filters.NewArgs()
 		filters.Add("name", fmt.Sprintf("^%s_%s", app.StackName(), service.Name))
 

cli/app/remove.go

@@ -9,7 +9,7 @@ import (
 	"coopcloud.tech/abra/pkg/autocomplete"
 	"coopcloud.tech/abra/pkg/client"
 	"coopcloud.tech/abra/pkg/log"
-	stack "coopcloud.tech/abra/pkg/upstream/stack"
+	"coopcloud.tech/abra/pkg/upstream/stack"
 	"github.com/AlecAivazis/survey/v2"
 	"github.com/docker/docker/api/types"
 	"github.com/spf13/cobra"
@@ -78,6 +78,22 @@ flag.`,
 			log.Fatal(err)
 		}
 
+		configs, err := client.GetConfigs(cl, context.Background(), app.Server, fs)
+		if err != nil {
+			log.Fatal(err)
+		}
+		configNames := client.GetConfigNames(configs)
+
+		if len(configNames) > 0 {
+			if err := client.RemoveConfigs(cl, context.Background(), configNames, internal.Force); err != nil {
+				log.Fatalf("removing configs failed: %s", err)
+			}
+
+			log.Infof("%d config(s) removed successfully", len(configNames))
+		} else {
+			log.Info("no configs to remove")
+		}
+
 		secretList, err := cl.SecretList(context.Background(), types.SecretListOptions{Filters: fs})
 		if err != nil {
 			log.Fatal(err)
@@ -120,7 +136,7 @@ flag.`,
 				log.Fatalf("removing volumes failed: %s", err)
 			}
 
-			log.Infof("%d volumes removed successfully", len(volumeNames))
+			log.Infof("%d volume(s) removed successfully", len(volumeNames))
 		} else {
 			log.Info("no volumes to remove")
 		}

cli/app/restart.go

@@ -9,8 +9,10 @@ import (
 	"coopcloud.tech/abra/pkg/autocomplete"
 	"coopcloud.tech/abra/pkg/client"
 	"coopcloud.tech/abra/pkg/log"
+	"coopcloud.tech/abra/pkg/ui"
 	upstream "coopcloud.tech/abra/pkg/upstream/service"
 	stack "coopcloud.tech/abra/pkg/upstream/stack"
+	"github.com/docker/docker/api/types"
 	"github.com/spf13/cobra"
 )
 
@@ -93,13 +95,36 @@ Pass "--all-services/-a" to restart all services.`,
 		for _, serviceName := range serviceNames {
 			stackServiceName := fmt.Sprintf("%s_%s", app.StackName(), serviceName)
 
+			service, _, err := cl.ServiceInspectWithRaw(
+				context.Background(),
+				stackServiceName,
+				types.ServiceInspectOptions{},
+			)
+			if err != nil {
+				log.Fatal(err)
+			}
+
 			log.Debugf("attempting to scale %s to 0", stackServiceName)
 
 			if err := upstream.RunServiceScale(context.Background(), cl, stackServiceName, 0); err != nil {
 				log.Fatal(err)
 			}
 
-			if err := stack.WaitOnService(context.Background(), cl, stackServiceName, app.Name); err != nil {
+			f, err := app.Filters(true, false, serviceName)
+			if err != nil {
+				log.Fatal(err)
+			}
+
+			waitOpts := stack.WaitOpts{
+				Services:   []ui.ServiceMeta{{Name: stackServiceName, ID: service.ID}},
+				AppName:    app.Name,
+				ServerName: app.Server,
+				Filters:    f,
+				NoLog:      true,
+				Quiet:      true,
+			}
+
+			if err := stack.WaitOnServices(cmd.Context(), cl, waitOpts); err != nil {
 				log.Fatal(err)
 			}
 
@@ -110,7 +135,7 @@ Pass "--all-services/-a" to restart all services.`,
 				log.Fatal(err)
 			}
 
-			if err := stack.WaitOnService(context.Background(), cl, stackServiceName, app.Name); err != nil {
+			if err := stack.WaitOnServices(cmd.Context(), cl, waitOpts); err != nil {
 				log.Fatal(err)
 			}
 

cli/app/rollback.go

@@ -194,7 +194,32 @@ beforehand. See "abra app backup" for more.`,
 			log.Fatal(err)
 		}
 
-		if err := stack.RunDeploy(cl, deployOpts, compose, stackName, internal.DontWaitConverge); err != nil {
+		stack.WaitTimeout, err = appPkg.GetTimeoutFromLabel(compose, stackName)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		log.Debugf("set waiting timeout to %d second(s)", stack.WaitTimeout)
+
+		serviceNames, err := appPkg.GetAppServiceNames(app.Name)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		f, err := app.Filters(true, false, serviceNames...)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		if err := stack.RunDeploy(
+			cl,
+			deployOpts,
+			compose,
+			stackName,
+			app.Server,
+			internal.DontWaitConverge,
+			f,
+		); err != nil {
 			log.Fatal(err)
 		}
 

cli/app/secret.go

@@ -145,9 +145,17 @@ var AppSecretInsertCommand = &cobra.Command{
 	Short:   "Insert secret",
 	Long: `This command inserts a secret into an app environment.
 
+Arbitrary secret insertion is not supported. Secrets that are inserted must
+match those configured in the recipe beforehand.
+
 This can be useful when you want to manually generate secrets for an app
 environment. Typically, you can let Abra generate them for you on app creation
 (see "abra app new --secrets/-S" for more).`,
+	Example: `  # insert regular secret
+  abra app secret insert 1312.net my_secret v1 mySuperSecret
+
+  # insert secret as file
+  abra app secret insert 1312.net my_secret v1 secret.txt -f`,
 	Args: cobra.MinimumNArgs(4),
 	ValidArgsFunction: func(
 		cmd *cobra.Command,
@@ -183,6 +191,26 @@ environment. Typically, you can let Abra generate them for you on app creation
 		version := args[2]
 		data := args[3]
 
+		composeFiles, err := app.Recipe.GetComposeFiles(app.Env)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		secrets, err := secret.ReadSecretsConfig(app.Path, composeFiles, app.StackName())
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		var isRecipeSecret bool
+		for secretName := range secrets {
+			if secretName == name {
+				isRecipeSecret = true
+			}
+		}
+		if !isRecipeSecret {
+			log.Fatalf("no secret %s available for recipe %s?", name, app.Recipe.Name)
+		}
+
 		if insertFromFile {
 			raw, err := os.ReadFile(data)
 			if err != nil {
@@ -196,7 +224,7 @@ environment. Typically, you can let Abra generate them for you on app creation
 		}
 
 		secretName := fmt.Sprintf("%s_%s_%s", app.StackName(), name, version)
-		if err := client.StoreSecret(cl, secretName, data, app.Server); err != nil {
+		if err := client.StoreSecret(cl, secretName, data); err != nil {
 			log.Fatal(err)
 		}
 
@@ -233,6 +261,11 @@ var AppSecretRmCommand = &cobra.Command{
 	Use:     "remove <domain> [[secret] | --all] [flags]",
 	Aliases: []string{"rm"},
 	Short:   "Remove a secret",
+	Long: `This command removes a secret from an app environment.
+
+Arbitrary secret removal is not supported. Secrets that are removed must
+match those configured in the recipe beforehand.`,
+	Example: "  abra app secret rm 1312.net oauth_key",
 	Args:    cobra.RangeArgs(1, 2),
 	ValidArgsFunction: func(
 		cmd *cobra.Command,

cli/app/undeploy.go

@@ -38,6 +38,10 @@ Passing "--prune/-p" does not remove those volumes.`,
 		app := internal.ValidateApp(args)
 		stackName := app.StackName()
 
+		if err := app.Recipe.EnsureExists(); err != nil {
+			log.Fatal(err)
+		}
+
 		cl, err := client.New(app.Server)
 		if err != nil {
 			log.Fatal(err)
@@ -64,6 +68,24 @@ Passing "--prune/-p" does not remove those volumes.`,
 			log.Fatal(err)
 		}
 
+		composeFiles, err := app.Recipe.GetComposeFiles(app.Env)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		opts := stack.Deploy{Composefiles: composeFiles, Namespace: stackName}
+		compose, err := appPkg.GetAppComposeConfig(app.Name, opts, app.Env)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		stack.WaitTimeout, err = appPkg.GetTimeoutFromLabel(compose, stackName)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		log.Info("initialising undeploy")
+
 		rmOpts := stack.Remove{
 			Namespaces: []string{stackName},
 			Detach:     false,
@@ -78,6 +100,8 @@ Passing "--prune/-p" does not remove those volumes.`,
 			}
 		}
 
+		log.Info("undeploy succeeded 🟢")
+
 		if err := app.WriteRecipeVersion(deployMeta.Version, false); err != nil {
 			log.Fatalf("writing recipe version failed: %s", err)
 		}

cli/app/upgrade.go

@@ -3,6 +3,7 @@ package app
 import (
 	"context"
 	"fmt"
+	"strings"
 
 	"coopcloud.tech/abra/cli/internal"
 	"coopcloud.tech/abra/pkg/app"
@@ -14,6 +15,7 @@ import (
 	"coopcloud.tech/abra/pkg/formatter"
 	"coopcloud.tech/abra/pkg/lint"
 	"coopcloud.tech/abra/pkg/log"
+	"coopcloud.tech/abra/pkg/recipe"
 	stack "coopcloud.tech/abra/pkg/upstream/stack"
 	"coopcloud.tech/tagcmp"
 	"github.com/AlecAivazis/survey/v2"
@@ -69,7 +71,13 @@ beforehand. See "abra app backup" for more.`,
 
 		app := internal.ValidateApp(args)
 
-		if err := app.Recipe.Ensure(internal.GetEnsureContext()); err != nil {
+		if err := app.Recipe.Ensure(recipe.EnsureContext{
+			Chaos:   internal.Chaos,
+			Offline: internal.Offline,
+			// Ignore the env version for now, to make sure we are at the latest commit.
+			// This enables us to get release notes, that were added after a release.
+			IgnoreEnvVersion: true,
+		}); err != nil {
 			log.Fatal(err)
 		}
 
@@ -109,7 +117,7 @@ beforehand. See "abra app backup" for more.`,
 		}
 
 		if deployMeta.Version != config.UNKNOWN_DEFAULT && chosenUpgrade == "" {
-			upgradeAvailable, err := ensureUpgradesAvailable(versions, &availableUpgrades, deployMeta)
+			upgradeAvailable, err := ensureUpgradesAvailable(app, versions, &availableUpgrades, deployMeta)
 			if err != nil {
 				log.Fatal(err)
 			}
@@ -142,10 +150,9 @@ beforehand. See "abra app backup" for more.`,
 
 		log.Debugf("choosing %s as version to upgrade", chosenUpgrade)
 
-		// NOTE(d1): if release notes written after git tag published, read them
-		// before we check out the tag and then they'll appear to be missing. this
-		// covers when we obviously will forget to write release notes before
-		// publishing
+		// Get the release notes before checking out the new version in the
+		// recipe. This enables us to get release notes, that were added after
+		// a release.
 		if err := getReleaseNotes(app, versions, chosenUpgrade, deployMeta, &upgradeReleaseNotes); err != nil {
 			log.Fatal(err)
 		}
@@ -207,9 +214,7 @@ beforehand. See "abra app backup" for more.`,
 			return
 		}
 
-		if upgradeReleaseNotes != "" && chosenUpgrade != "" {
-			fmt.Print(upgradeReleaseNotes)
-		} else {
+		if upgradeReleaseNotes == "" {
 			upgradeWarnMessages = append(
 				upgradeWarnMessages,
 				fmt.Sprintf("no release notes available for %s", chosenUpgrade),
@@ -233,7 +238,25 @@ beforehand. See "abra app backup" for more.`,
 
 		log.Debugf("set waiting timeout to %d second(s)", stack.WaitTimeout)
 
-		if err := stack.RunDeploy(cl, deployOpts, compose, stackName, internal.DontWaitConverge); err != nil {
+		serviceNames, err := appPkg.GetAppServiceNames(app.Name)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		f, err := app.Filters(true, false, serviceNames...)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		if err := stack.RunDeploy(
+			cl,
+			deployOpts,
+			compose,
+			stackName,
+			app.Server,
+			internal.DontWaitConverge,
+			f,
+		); err != nil {
 			log.Fatal(err)
 		}
 
@@ -291,18 +314,18 @@ func getReleaseNotes(
 ) error {
 	parsedChosenUpgrade, err := tagcmp.Parse(chosenUpgrade)
 	if err != nil {
-		return err
+		return fmt.Errorf("parsing chosen upgrade version failed: %s", err)
 	}
 
 	parsedDeployedVersion, err := tagcmp.Parse(deployMeta.Version)
 	if err != nil {
-		return err
+		return fmt.Errorf("parsing deployment version failed: %s", err)
 	}
 
 	for _, version := range internal.SortVersionsDesc(versions) {
 		parsedVersion, err := tagcmp.Parse(version)
 		if err != nil {
-			return err
+			return fmt.Errorf("parsing recipe version failed: %s", err)
 		}
 
 		if parsedVersion.IsGreaterThan(parsedDeployedVersion) &&
@@ -313,6 +336,11 @@ func getReleaseNotes(
 			}
 
 			if note != "" {
+				// NOTE(d1): trim any final newline on the end of the note itself before
+				//           we manually handle newlines (for multiple release notes and
+				//           ensuring space between the warning messages)
+				note = strings.TrimSuffix(note, "\n")
+
 				*upgradeReleaseNotes += fmt.Sprintf("%s\n", note)
 			}
 		}
@@ -323,19 +351,20 @@ func getReleaseNotes(
 
 // ensureUpgradesAvailable ensures that there are available upgrades.
 func ensureUpgradesAvailable(
+	app app.App,
 	versions []string,
 	availableUpgrades *[]string,
 	deployMeta stack.DeployMeta,
 ) (bool, error) {
 	parsedDeployedVersion, err := tagcmp.Parse(deployMeta.Version)
 	if err != nil {
-		return false, err
+		return false, fmt.Errorf("parsing deployed version failed: %s", err)
 	}
 
 	for _, version := range versions {
 		parsedVersion, err := tagcmp.Parse(version)
 		if err != nil {
-			return false, err
+			return false, fmt.Errorf("parsing recipe version failed: %s", err)
 		}
 
 		if parsedVersion.IsGreaterThan(parsedDeployedVersion) &&

cli/app/volume.go

@@ -2,6 +2,7 @@ package app
 
 import (
 	"context"
+	"fmt"
 
 	"coopcloud.tech/abra/cli/internal"
 	"coopcloud.tech/abra/pkg/autocomplete"
@@ -71,7 +72,7 @@ var AppVolumeListCommand = &cobra.Command{
 }
 
 var AppVolumeRemoveCommand = &cobra.Command{
-	Use:   "remove <domain> [flags]",
+	Use:   "remove <domain> [volume] [flags]",
 	Short: "Remove volume(s) associated with an app",
 	Long: `Remove volumes associated with an app.
 
@@ -83,6 +84,11 @@ you to make a seclection. Use the "?" key to see more help on navigating this
 interface.
 
 Passing "--force/-f" will select all volumes for removal. Be careful.`,
+	Example: `  # delete volumes interactively
+  abra app volume rm 1312.net
+
+  # delete specific volume
+  abra app volume rm 1312.net my_volume`,
 	Aliases: []string{"rm"},
 	Args:    cobra.MinimumNArgs(1),
 	ValidArgsFunction: func(
@@ -94,6 +100,11 @@ Passing "--force/-f" will select all volumes for removal. Be careful.`,
 	Run: func(cmd *cobra.Command, args []string) {
 		app := internal.ValidateApp(args)
 
+		var volumeToDelete string
+		if len(args) == 2 {
+			volumeToDelete = args[1]
+		}
+
 		cl, err := client.New(app.Server)
 		if err != nil {
 			log.Fatal(err)
@@ -119,6 +130,30 @@ Passing "--force/-f" will select all volumes for removal. Be careful.`,
 		}
 		volumeNames := client.GetVolumeNames(volumeList)
 
+		if volumeToDelete != "" {
+			var exactMatch bool
+
+			fullVolumeToDeleteName := fmt.Sprintf("%s_%s", app.StackName(), volumeToDelete)
+			for _, volName := range volumeNames {
+				if volName == fullVolumeToDeleteName {
+					exactMatch = true
+				}
+			}
+
+			if !exactMatch {
+				log.Fatalf("unable to remove volume: no volume with name '%s'?", volumeToDelete)
+			}
+
+			err := client.RemoveVolumes(cl, context.Background(), []string{fullVolumeToDeleteName}, internal.Force, 5)
+			if err != nil {
+				log.Fatalf("removing volume %s failed: %s", volumeToDelete, err)
+			}
+
+			log.Infof("volume %s removed successfully", volumeToDelete)
+
+			return
+		}
+
 		var volumesToRemove []string
 		if !internal.Force && !internal.NoInput {
 			volumesPrompt := &survey.MultiSelect{

cli/internal/command.go

@@ -24,7 +24,7 @@ import (
 func RunCmdRemote(
 	cl *dockerClient.Client,
 	app appPkg.App,
-	requestTTY bool,
+	disableTTY bool,
 	abraSh, serviceName, cmdName, cmdArgs, remoteUser string) error {
 	filters := filters.NewArgs()
 	filters.Add("name", fmt.Sprintf("^%s_%s", app.StackName(), serviceName))
@@ -84,8 +84,10 @@ func RunCmdRemote(
 	}
 
 	execCreateOpts.Cmd = cmd
-	execCreateOpts.Tty = requestTTY
-	if !requestTTY {
+
+	execCreateOpts.Tty = true
+	if disableTTY {
+		execCreateOpts.Tty = false
 		log.Debugf("not requesting a remote TTY")
 	}
 

cli/internal/deploy.go

@@ -1,6 +1,7 @@
 package internal
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"sort"
@@ -46,7 +47,7 @@ func DeployOverview(
 	app appPkg.App,
 	deployedVersion string,
 	toDeployVersion string,
-	info string,
+	releaseNotes string,
 	warnMessages []string,
 ) error {
 	deployConfig := "compose.yml"
@@ -85,8 +86,8 @@ func DeployOverview(
 
 	fmt.Println(overview)
 
-	if info != "" {
-		fmt.Println(info)
+	if releaseNotes != "" {
+		fmt.Print(releaseNotes)
 	}
 
 	for _, msg := range warnMessages {
@@ -140,13 +141,66 @@ func getDeployType(currentVersion, newVersion string) string {
 	return "DOWNGRADE"
 }
 
+// MoveOverview shows a overview before moving an app to a different server
+func MoveOverview(
+	app appPkg.App,
+	newServer string,
+	secrets []string,
+	volumes []string,
+) {
+	server := app.Server
+	if app.Server == "default" {
+		server = "local"
+	}
+
+	domain := app.Domain
+	if domain == "" {
+		domain = config.NO_DOMAIN_DEFAULT
+	}
+
+	rows := [][]string{
+		{"DOMAIN", domain},
+		{"RECIPE", app.Recipe.Name},
+		{"OLD SERVER", server},
+		{"New SERVER", newServer},
+		{"SECRETS", strings.Join(secrets, "\n")},
+		{"VOLUMES", strings.Join(volumes, "\n")},
+	}
+
+	overview := formatter.CreateOverview("MOVE OVERVIEW", rows)
+
+	fmt.Println(overview)
+}
+
+func PromptProcced() error {
+	if NoInput {
+		return nil
+	}
+
+	if Dry {
+		return fmt.Errorf("dry run")
+	}
+
+	response := false
+	prompt := &survey.Confirm{Message: "proceed?"}
+	if err := survey.AskOne(prompt, &response); err != nil {
+		return err
+	}
+
+	if !response {
+		return errors.New("cancelled")
+	}
+
+	return nil
+}
+
 // PostCmds parses a string of commands and executes them inside of the respective services
 // the commands string must have the following format:
 // "<service> <command> <arguments>|<service> <command> <arguments>|... "
 func PostCmds(cl *dockerClient.Client, app appPkg.App, commands string) error {
 	if _, err := os.Stat(app.Recipe.AbraShPath); err != nil {
 		if os.IsNotExist(err) {
-			return fmt.Errorf(fmt.Sprintf("%s does not exist for %s?", app.Recipe.AbraShPath, app.Name))
+			return fmt.Errorf("%s does not exist for %s?", app.Recipe.AbraShPath, app.Name)
 		}
 		return err
 	}
@@ -154,7 +208,7 @@ func PostCmds(cl *dockerClient.Client, app appPkg.App, commands string) error {
 	for _, command := range strings.Split(commands, "|") {
 		commandParts := strings.Split(command, " ")
 		if len(commandParts) < 2 {
-			return fmt.Errorf(fmt.Sprintf("not enough arguments: %s", command))
+			return fmt.Errorf("not enough arguments: %s", command)
 		}
 		targetServiceName := commandParts[0]
 		cmdName := commandParts[1]
@@ -181,7 +235,7 @@ func PostCmds(cl *dockerClient.Client, app appPkg.App, commands string) error {
 		}
 
 		if !matchingServiceName {
-			return fmt.Errorf(fmt.Sprintf("no service %s for %s?", targetServiceName, app.Name))
+			return fmt.Errorf("no service %s for %s?", targetServiceName, app.Name)
 		}
 
 		log.Debugf("running command %s %s within the context of %s_%s", cmdName, parsedCmdArgs, app.StackName(), targetServiceName)

cli/internal/validate.go

@@ -17,34 +17,34 @@ func ValidateRecipe(args []string, cmdName string) recipe.Recipe {
 		recipeName = args[0]
 	}
 
-	if recipeName == "" && !NoInput {
-		var recipes []string
+	var recipes []string
 
-		catl, err := recipe.ReadRecipeCatalogue(Offline)
-		if err != nil {
-			log.Fatal(err)
-		}
+	catl, err := recipe.ReadRecipeCatalogue(Offline)
+	if err != nil {
+		log.Fatal(err)
+	}
 
-		knownRecipes := make(map[string]bool)
-		for name := range catl {
-			knownRecipes[name] = true
-		}
-
-		localRecipes, err := recipe.GetRecipesLocal()
-		if err != nil {
-			log.Fatal(err)
-		}
+	knownRecipes := make(map[string]bool)
+	for name := range catl {
+		knownRecipes[name] = true
+	}
 
+	localRecipes, err := recipe.GetRecipesLocal()
+	if err != nil {
+		log.Debugf("can't read local recipes: %s", err)
+	} else {
 		for _, recipeLocal := range localRecipes {
 			if _, ok := knownRecipes[recipeLocal]; !ok {
 				knownRecipes[recipeLocal] = true
 			}
 		}
+	}
 
-		for recipeName := range knownRecipes {
-			recipes = append(recipes, recipeName)
-		}
+	for recipeName := range knownRecipes {
+		recipes = append(recipes, recipeName)
+	}
 
+	if recipeName == "" && !NoInput {
 		prompt := &survey.Select{
 			Message: "Select recipe",
 			Options: recipes,
@@ -58,11 +58,17 @@ func ValidateRecipe(args []string, cmdName string) recipe.Recipe {
 		log.Fatal("no recipe name provided")
 	}
 
+	if _, ok := knownRecipes[recipeName]; !ok {
+		if !strings.Contains(recipeName, "/") {
+			log.Fatalf("no recipe '%s' exists?", recipeName)
+		}
+	}
+
 	chosenRecipe := recipe.Get(recipeName)
-	err := chosenRecipe.EnsureExists()
-	if err != nil {
+	if err := chosenRecipe.EnsureExists(); err != nil {
 		log.Fatal(err)
 	}
+
 	_, err = chosenRecipe.GetComposeConfig(nil)
 	if err != nil {
 		if cmdName == "generate" {

cli/recipe/fetch.go

@@ -1,11 +1,15 @@
 package recipe
 
 import (
+	"os"
+
 	"coopcloud.tech/abra/cli/internal"
 	"coopcloud.tech/abra/pkg/autocomplete"
 	"coopcloud.tech/abra/pkg/formatter"
 	"coopcloud.tech/abra/pkg/log"
 	"coopcloud.tech/abra/pkg/recipe"
+	"github.com/go-git/go-git/v5"
+	gitCfg "github.com/go-git/go-git/v5/config"
 	"github.com/spf13/cobra"
 )
 
@@ -13,7 +17,16 @@ var RecipeFetchCommand = &cobra.Command{
 	Use:     "fetch [recipe | --all] [flags]",
 	Aliases: []string{"f"},
 	Short:   "Clone recipe(s) locally",
+	Long:    `Using "--force/-f" Git syncs an existing recipe. It does not erase unstaged changes.`,
 	Args:    cobra.RangeArgs(0, 1),
+	Example: `  # fetch from recipe catalogue
+  abra recipe fetch gitea
+
+  # fetch from remote recipe
+  abra recipe fetch git.foo.org/recipes/myrecipe
+
+  # fetch with ssh remote for hacking
+  abra recipe fetch gitea --ssh`,
 	ValidArgsFunction: func(
 		cmd *cobra.Command,
 		args []string,
@@ -34,12 +47,40 @@ var RecipeFetchCommand = &cobra.Command{
 			log.Fatal("cannot use [recipe] and --all/-a together")
 		}
 
-		ensureCtx := internal.GetEnsureContext()
 		if recipeName != "" {
-			r := internal.ValidateRecipe(args, cmd.Name())
-			if err := r.Ensure(ensureCtx); err != nil {
-				log.Fatal(err)
+			r := recipe.Get(recipeName)
+			if _, err := os.Stat(r.Dir); !os.IsNotExist(err) {
+				if !force {
+					log.Warnf("%s is already fetched", r.Name)
+					return
+				}
 			}
+
+			r = internal.ValidateRecipe(args, cmd.Name())
+
+			if sshRemote {
+				if r.SSHURL == "" {
+					log.Warnf("unable to discover SSH remote for %s", r.Name)
+					return
+				}
+
+				repo, err := git.PlainOpen(r.Dir)
+				if err != nil {
+					log.Fatalf("unable to open %s: %s", r.Dir, err)
+				}
+
+				if err = repo.DeleteRemote("origin"); err != nil {
+					log.Fatalf("unable to remove default remote in %s: %s", r.Dir, err)
+				}
+
+				if _, err := repo.CreateRemote(&gitCfg.RemoteConfig{
+					Name: "origin",
+					URLs: []string{r.SSHURL},
+				}); err != nil {
+					log.Fatalf("unable to set SSH remote in %s: %s", r.Dir, err)
+				}
+			}
+
 			return
 		}
 
@@ -49,6 +90,7 @@ var RecipeFetchCommand = &cobra.Command{
 		}
 
 		catlBar := formatter.CreateProgressbar(len(catalogue), "fetching latest recipes...")
+		ensureCtx := internal.GetEnsureContext()
 		for recipeName := range catalogue {
 			r := recipe.Get(recipeName)
 			if err := r.Ensure(ensureCtx); err != nil {
@@ -61,6 +103,8 @@ var RecipeFetchCommand = &cobra.Command{
 
 var (
 	fetchAllRecipes bool
+	sshRemote       bool
+	force           bool
 )
 
 func init() {
@@ -71,4 +115,20 @@ func init() {
 		false,
 		"fetch all recipes",
 	)
+
+	RecipeFetchCommand.Flags().BoolVarP(
+		&sshRemote,
+		"ssh",
+		"s",
+		false,
+		"automatically set ssh remote",
+	)
+
+	RecipeFetchCommand.Flags().BoolVarP(
+		&force,
+		"force",
+		"f",
+		false,
+		"force re-fetch",
+	)
 }

cli/run.go

@@ -31,20 +31,21 @@ func Run(version, commit string) {
 			"upgrade",
 		},
 		PersistentPreRun: func(cmd *cobra.Command, args []string) {
-			paths := []string{
-				config.ABRA_DIR,
-				config.SERVERS_DIR,
-				config.RECIPES_DIR,
-				config.VENDOR_DIR, // TODO(d1): remove > 0.9.x
-				config.BACKUP_DIR, // TODO(d1): remove > 0.9.x
+			dirs := []map[string]os.FileMode{
+				{config.ABRA_DIR: 0764},
+				{config.SERVERS_DIR: 0700},
+				{config.RECIPES_DIR: 0764},
+				{config.LOGS_DIR: 0764},
 			}
 
-			for _, path := range paths {
-				if err := os.Mkdir(path, 0764); err != nil {
-					if !os.IsExist(err) {
-						log.Fatal(err)
+			for _, dir := range dirs {
+				for path, perm := range dir {
+					if err := os.Mkdir(path, perm); err != nil {
+						if !os.IsExist(err) {
+							log.Fatal(err)
+						}
+						continue
 					}
-					continue
 				}
 			}
 
@@ -72,7 +73,8 @@ func Run(version, commit string) {
 		Aliases: []string{"m"},
 		Short:   "Generate manpage",
 		Example: `  # generate the man pages into /usr/local/share/man/man1
-  sudo abra man
+  abra_path=$(which abra)  # pass abra absolute path to sudo below
+  sudo $abra_path man
   sudo mandb
 
   # read the man pages
@@ -202,6 +204,7 @@ func Run(version, commit string) {
 		app.AppRestartCommand,
 		app.AppRestoreCommand,
 		app.AppRollbackCommand,
+		app.AppMoveCommand,
 		app.AppRunCommand,
 		app.AppSecretCommand,
 		app.AppServicesCommand,

cli/server/add.go

@@ -103,8 +103,7 @@ developer machine. The domain is then set to "default".`,
 
 		if _, err := client.New(name, timeout); err != nil {
 			cleanUp(name)
-			log.Debugf("ssh %s error: %s", name, sshPkg.Fatal(name, err))
-			log.Fatalf("can't ssh to %s, make sure \"ssh %s\" works", name, name)
+			log.Fatalf("ssh %s error: %s", name, sshPkg.Fatal(name, err))
 		}
 
 		if created {

cli/updater/updater.go

@@ -441,7 +441,25 @@ func upgrade(cl *dockerclient.Client, stackName, recipeName, upgradeVersion stri
 
 	log.Infof("upgrade %s (%s) to version %s", stackName, recipeName, upgradeVersion)
 
-	err = stack.RunDeploy(cl, deployOpts, compose, stackName, true)
+	serviceNames, err := appPkg.GetAppServiceNames(app.Name)
+	if err != nil {
+		return err
+	}
+
+	f, err := app.Filters(true, false, serviceNames...)
+	if err != nil {
+		return err
+	}
+
+	err = stack.RunDeploy(
+		cl,
+		deployOpts,
+		compose,
+		stackName,
+		app.Server,
+		true,
+		f,
+	)
 
 	return err
 }

go.mod

@@ -1,69 +1,76 @@
 module coopcloud.tech/abra
 
-go 1.23.0
+go 1.24.0
 
-toolchain go1.23.1
+toolchain go1.24.1
 
 require (
-	coopcloud.tech/tagcmp v0.0.0-20230809071031-eb3e7758d4eb
+	coopcloud.tech/tagcmp v0.0.0-20250818180036-0ec1b205b5ca
 	git.coopcloud.tech/toolshed/godotenv v1.5.2-0.20250103171850-4d0ca41daa5c
 	github.com/AlecAivazis/survey/v2 v2.3.7
+	github.com/charmbracelet/bubbletea v1.3.6
 	github.com/charmbracelet/lipgloss v1.1.0
-	github.com/charmbracelet/log v0.4.1
+	github.com/charmbracelet/log v0.4.2
 	github.com/distribution/reference v0.6.0
-	github.com/docker/cli v28.0.1+incompatible
-	github.com/docker/docker v28.0.1+incompatible
+	github.com/docker/cli v28.3.3+incompatible
+	github.com/docker/docker v28.3.3+incompatible
 	github.com/docker/go-units v0.5.0
-	github.com/go-git/go-git/v5 v5.14.0
+	github.com/go-git/go-git/v5 v5.16.2
 	github.com/google/go-cmp v0.7.0
+	github.com/leonelquinteros/gotext v1.7.2
 	github.com/moby/sys/signal v0.7.1
 	github.com/moby/term v0.5.2
 	github.com/pkg/errors v0.9.1
 	github.com/schollz/progressbar/v3 v3.18.0
-	golang.org/x/term v0.30.0
+	golang.org/x/term v0.34.0
 	gopkg.in/yaml.v3 v3.0.1
 	gotest.tools/v3 v3.5.2
 )
 
 require (
-	dario.cat/mergo v1.0.1 // indirect
-	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
+	dario.cat/mergo v1.0.2 // indirect
+	github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
-	github.com/BurntSushi/toml v1.4.0 // indirect
+	github.com/BurntSushi/toml v1.5.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
-	github.com/ProtonMail/go-crypto v1.1.6 // indirect
+	github.com/ProtonMail/go-crypto v1.3.0 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc // indirect
-	github.com/charmbracelet/x/ansi v0.8.0 // indirect
+	github.com/charmbracelet/colorprofile v0.3.2 // indirect
+	github.com/charmbracelet/x/ansi v0.10.1 // indirect
 	github.com/charmbracelet/x/cellbuf v0.0.13 // indirect
 	github.com/charmbracelet/x/term v0.2.1 // indirect
-	github.com/cloudflare/circl v1.6.0 // indirect
+	github.com/cloudflare/circl v1.6.1 // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.6 // indirect
+	github.com/containerd/platforms v0.2.1 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c // indirect
-	github.com/docker/go-connections v0.5.0 // indirect
+	github.com/docker/go-connections v0.6.0 // indirect
 	github.com/docker/go-metrics v0.0.1 // indirect
 	github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
+	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.6.0 // indirect
 	github.com/ghodss/yaml v1.0.0 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-git/go-billy/v5 v5.6.2 // indirect
 	github.com/go-logfmt/logfmt v0.6.0 // indirect
-	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
@@ -73,61 +80,63 @@ require (
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-localereader v0.0.1 // indirect
 	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
 	github.com/miekg/pkcs11 v1.1.1 // indirect
 	github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
-	github.com/mmcloughlin/avo v0.6.0 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/sys/mountinfo v0.6.2 // indirect
-	github.com/moby/sys/user v0.3.0 // indirect
+	github.com/moby/go-archive v0.1.0 // indirect
+	github.com/moby/sys/atomicwriter v0.1.0 // indirect
+	github.com/moby/sys/mountinfo v0.7.2 // indirect
+	github.com/moby/sys/user v0.4.0 // indirect
 	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
+	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
+	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/muesli/termenv v0.16.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/runc v1.1.13 // indirect
 	github.com/opencontainers/runtime-spec v1.1.0 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
-	github.com/pjbgf/sha1cd v0.3.2 // indirect
+	github.com/pjbgf/sha1cd v0.4.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/common v0.63.0 // indirect
-	github.com/prometheus/procfs v0.15.1 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.65.0 // indirect
+	github.com/prometheus/procfs v0.17.0 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/skeema/knownhosts v1.3.1 // indirect
-	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/spf13/pflag v1.0.7 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
-	go.opentelemetry.io/otel v1.35.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.35.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0 // indirect
+	go.opentelemetry.io/otel v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0 // indirect
-	go.opentelemetry.io/otel/metric v1.35.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.35.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.35.0 // indirect
-	go.opentelemetry.io/otel/trace v1.35.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.5.0 // indirect
-	golang.org/x/crypto v0.36.0 // indirect
-	golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 // indirect
-	golang.org/x/mod v0.24.0 // indirect
-	golang.org/x/net v0.37.0 // indirect
-	golang.org/x/sync v0.12.0 // indirect
-	golang.org/x/text v0.23.0 // indirect
-	golang.org/x/time v0.11.0 // indirect
-	golang.org/x/tools v0.31.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250313205543-e70fdf4c4cb4 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250313205543-e70fdf4c4cb4 // indirect
-	google.golang.org/grpc v1.71.0 // indirect
-	google.golang.org/protobuf v1.36.5 // indirect
+	go.opentelemetry.io/otel/metric v1.37.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.37.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.37.0 // indirect
+	go.opentelemetry.io/otel/trace v1.37.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.7.1 // indirect
+	golang.org/x/crypto v0.41.0 // indirect
+	golang.org/x/exp v0.0.0-20250813145105-42675adae3e6 // indirect
+	golang.org/x/net v0.43.0 // indirect
+	golang.org/x/sync v0.16.0 // indirect
+	golang.org/x/text v0.28.0 // indirect
+	golang.org/x/time v0.12.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250811230008-5f3141c8851a // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a // indirect
+	google.golang.org/grpc v1.74.2 // indirect
+	google.golang.org/protobuf v1.36.7 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 )
@@ -140,15 +149,15 @@ require (
 	github.com/fvbommel/sortorder v1.1.0 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.7
+	github.com/hashicorp/go-retryablehttp v0.7.8
 	github.com/moby/patternmatcher v0.6.0 // indirect
 	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
-	github.com/prometheus/client_golang v1.21.1 // indirect
-	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
+	github.com/prometheus/client_golang v1.23.0 // indirect
+	github.com/sergi/go-diff v1.4.0 // indirect
 	github.com/spf13/cobra v1.9.1
 	github.com/stretchr/testify v1.10.0
 	github.com/theupdateframework/notary v0.7.0 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
-	golang.org/x/sys v0.31.0
+	golang.org/x/sys v0.35.0
 )

go.sum

@@ -24,13 +24,21 @@ cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0Zeo
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
 coopcloud.tech/tagcmp v0.0.0-20230809071031-eb3e7758d4eb h1:Ws6WEwKXeaYEkfdkX6AqX1XLPuaCeyStEtxbmEJPllk=
 coopcloud.tech/tagcmp v0.0.0-20230809071031-eb3e7758d4eb/go.mod h1:ESVm0wQKcbcFi06jItF3rI7enf4Jt2PvbkWpDDHk1DQ=
+coopcloud.tech/tagcmp v0.0.0-20250427094623-9ea3bbbde8e5 h1:tphJCjFJw9fdjyKnbU0f7f3z5KtYE8VbUcAfu+oHKg8=
+coopcloud.tech/tagcmp v0.0.0-20250427094623-9ea3bbbde8e5/go.mod h1:ESVm0wQKcbcFi06jItF3rI7enf4Jt2PvbkWpDDHk1DQ=
+coopcloud.tech/tagcmp v0.0.0-20250818180036-0ec1b205b5ca h1:gSD53tBAsbIGq4SnFfq+mEep6foekQ2a5ea7b38qkm0=
+coopcloud.tech/tagcmp v0.0.0-20250818180036-0ec1b205b5ca/go.mod h1:ESVm0wQKcbcFi06jItF3rI7enf4Jt2PvbkWpDDHk1DQ=
 dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
 dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
+dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
+dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
 git.coopcloud.tech/toolshed/godotenv v1.5.2-0.20250103171850-4d0ca41daa5c h1:oeKnUB79PKYD8D0/unYuu7MRcWryQQWOns8+JL+acrs=
 git.coopcloud.tech/toolshed/godotenv v1.5.2-0.20250103171850-4d0ca41daa5c/go.mod h1:fQuhwrpg6qb9NlFXKYi/LysWu1wxjraS8sxyW12CUF0=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
 github.com/AlecAivazis/survey/v2 v2.3.7 h1:6I/u8FvytdGsgonrYsVn2t8t4QiRnh6QSTqkkhIiSjQ=
 github.com/AlecAivazis/survey/v2 v2.3.7/go.mod h1:xUTIdE4KCOIjsBAE1JYsUPoCqYdZ1reCfTwbto0Fduo=
 github.com/Azure/azure-sdk-for-go v16.2.1+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
@@ -51,6 +59,8 @@ github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03
 github.com/BurntSushi/toml v1.0.0/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
 github.com/BurntSushi/toml v1.4.0 h1:kuoIxZQy2WRRk1pttg9asf+WVv6tWQuBNVmK8+nqPr0=
 github.com/BurntSushi/toml v1.4.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
+github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
+github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/Microsoft/go-winio v0.4.11/go.mod h1:VhR8bwka0BXejwEJY73c50VrPtXAaKcyvVC4A4RozmA=
 github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=
@@ -79,10 +89,10 @@ github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb0
 github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2 h1:+vx7roKuyA63nhn5WAunQHLTznkw5W8b1Xc0dNjp83s=
 github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2/go.mod h1:HBCaDeC1lPdgDeDbhX8XFpy1jqjK0IBG8W5K+xYqA0w=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
-github.com/ProtonMail/go-crypto v1.1.3 h1:nRBOetoydLeUb4nHajyO2bKqMLfWQ/ZPwkXqXxPxCFk=
-github.com/ProtonMail/go-crypto v1.1.3/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
 github.com/ProtonMail/go-crypto v1.1.6 h1:ZcV+Ropw6Qn0AX9brlQLAUXfqLBc7Bl+f/DmNxpLfdw=
 github.com/ProtonMail/go-crypto v1.1.6/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
+github.com/ProtonMail/go-crypto v1.3.0 h1:ILq8+Sf5If5DCpHQp4PbZdS1J7HDFRXz/+xKBiRGFrw=
+github.com/ProtonMail/go-crypto v1.3.0/go.mod h1:9whxjD8Rbs29b4XWbB8irEcE8KHMqaR2e7GWU1R+/PE=
 github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
@@ -132,26 +142,34 @@ github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0/go.mod h1:D/8v3k
 github.com/cenkalti/backoff/v4 v4.1.1/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
+github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/charmbracelet/bubbletea v1.3.4 h1:kCg7B+jSCFPLYRA52SDZjr51kG/fMUEoPoZrkaDHyoI=
+github.com/charmbracelet/bubbletea v1.3.4/go.mod h1:dtcUCyCGEX3g9tosuYiut3MXgY/Jsv9nKVdibKKRRXo=
+github.com/charmbracelet/bubbletea v1.3.6 h1:VkHIxPJQeDt0aFJIsVxw8BQdh/F/L2KKZGsK6et5taU=
+github.com/charmbracelet/bubbletea v1.3.6/go.mod h1:oQD9VCRQFF8KplacJLo28/jofOI2ToOfGYeFgBBxHOc=
 github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc h1:4pZI35227imm7yK2bGPcfpFEmuY1gc2YSTShr4iJBfs=
 github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc/go.mod h1:X4/0JoqgTIPSFcRA/P6INZzIuyqdFY5rm8tb41s9okk=
-github.com/charmbracelet/lipgloss v1.0.0 h1:O7VkGDvqEdGi93X+DeqsQ7PKHDgtQfF8j8/O2qFMQNg=
-github.com/charmbracelet/lipgloss v1.0.0/go.mod h1:U5fy9Z+C38obMs+T+tJqst9VGzlOYGj4ri9reL3qUlo=
+github.com/charmbracelet/colorprofile v0.3.1 h1:k8dTHMd7fgw4bnFd7jXTLZrSU/CQrKnL3m+AxCzDz40=
+github.com/charmbracelet/colorprofile v0.3.1/go.mod h1:/GkGusxNs8VB/RSOh3fu0TJmQ4ICMMPApIIVn0KszZ0=
+github.com/charmbracelet/colorprofile v0.3.2 h1:9J27WdztfJQVAQKX2WOlSSRB+5gaKqqITmrvb1uTIiI=
+github.com/charmbracelet/colorprofile v0.3.2/go.mod h1:mTD5XzNeWHj8oqHb+S1bssQb7vIHbepiebQ2kPKVKbI=
 github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=
 github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30=
-github.com/charmbracelet/log v0.4.0 h1:G9bQAcx8rWA2T3pWvx7YtPTPwgqpk7D68BX21IRW8ZM=
-github.com/charmbracelet/log v0.4.0/go.mod h1:63bXt/djrizTec0l11H20t8FDSvA4CRZJ1KH22MdptM=
 github.com/charmbracelet/log v0.4.1 h1:6AYnoHKADkghm/vt4neaNEXkxcXLSV2g1rdyFDOpTyk=
 github.com/charmbracelet/log v0.4.1/go.mod h1:pXgyTsqsVu4N9hGdHmQ0xEA4RsXof402LX9ZgiITn2I=
-github.com/charmbracelet/x/ansi v0.6.0 h1:qOznutrb93gx9oMiGf7caF7bqqubh6YIM0SWKyA08pA=
-github.com/charmbracelet/x/ansi v0.6.0/go.mod h1:KBUFw1la39nl0dLl10l5ORDAqGXaeurTQmwyyVKse/Q=
+github.com/charmbracelet/log v0.4.2 h1:hYt8Qj6a8yLnvR+h7MwsJv/XvmBJXiueUcI3cIxsyig=
+github.com/charmbracelet/log v0.4.2/go.mod h1:qifHGX/tc7eluv2R6pWIpyHDDrrb/AG71Pf2ysQu5nw=
 github.com/charmbracelet/x/ansi v0.8.0 h1:9GTq3xq9caJW8ZrBTe0LIe2fvfLR/bYXKTx2llXn7xE=
 github.com/charmbracelet/x/ansi v0.8.0/go.mod h1:wdYl/ONOLHLIVmQaxbIYEC/cRKOQyjTkowiI4blgS9Q=
+github.com/charmbracelet/x/ansi v0.10.1 h1:rL3Koar5XvX0pHGfovN03f5cxLbCF2YvLeyz7D2jVDQ=
+github.com/charmbracelet/x/ansi v0.10.1/go.mod h1:3RQDQ6lDnROptfpWuUVIUG64bD2g2BgntdxH0Ya5TeE=
 github.com/charmbracelet/x/cellbuf v0.0.13 h1:/KBBKHuVRbq1lYx5BzEHBAFBP8VcQzJejZ/IA3iR28k=
 github.com/charmbracelet/x/cellbuf v0.0.13/go.mod h1:xe0nKWGd3eJgtqZRaN9RjMtK7xUYchjzPr7q6kcvCCs=
 github.com/charmbracelet/x/exp/golden v0.0.0-20240806155701-69247e0abc2a h1:G99klV19u0QnhiizODirwVksQB91TJKV/UaTnACcG30=
@@ -175,10 +193,10 @@ github.com/cilium/ebpf v0.7.0/go.mod h1:/oI2+1shJiTGAMgl6/RgJr36Eo1jzrRcAWbcXO2u
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cloudflare/cfssl v0.0.0-20180223231731-4e2dcbde5004 h1:lkAMpLVBDaj17e85keuznYcH5rqI438v41pKcBl4ZxQ=
 github.com/cloudflare/cfssl v0.0.0-20180223231731-4e2dcbde5004/go.mod h1:yMWuSON2oQp+43nFtAV/uvKQIFpSPerB57DCt9t8sSA=
-github.com/cloudflare/circl v1.5.0 h1:hxIWksrX6XN5a1L2TI/h53AGPhNHoUBo+TD1ms9+pys=
-github.com/cloudflare/circl v1.5.0/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
 github.com/cloudflare/circl v1.6.0 h1:cr5JKic4HI+LkINy2lg3W2jF8sHCVTBncJr5gIIq7qk=
 github.com/cloudflare/circl v1.6.0/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
+github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0=
+github.com/cloudflare/circl v1.6.1/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
@@ -224,6 +242,10 @@ github.com/containerd/continuity v0.0.0-20200710164510-efbc4488d8fe/go.mod h1:cE
 github.com/containerd/continuity v0.0.0-20201208142359-180525291bb7/go.mod h1:kR3BEg7bDFaEddKm54WSmrol1fKWDU1nKYkgrcgZT7Y=
 github.com/containerd/continuity v0.0.0-20210208174643-50096c924a4e/go.mod h1:EXlVlkqNba9rJe3j7w3Xa924itAMLgZH4UD/Q4PExuQ=
 github.com/containerd/continuity v0.1.0/go.mod h1:ICJu0PwR54nI0yPEnJ6jcS+J7CZAUXrLh8lPo2knzsM=
+github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
+github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
+github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
 github.com/containerd/fifo v0.0.0-20180307165137-3d5202aec260/go.mod h1:ODA38xgv3Kuk8dQz2ZQXpnv/UZZUHUCL7pnLehbXgQI=
 github.com/containerd/fifo v0.0.0-20190226154929-a9fb20d87448/go.mod h1:ODA38xgv3Kuk8dQz2ZQXpnv/UZZUHUCL7pnLehbXgQI=
 github.com/containerd/fifo v0.0.0-20200410184934-f15a3290365b/go.mod h1:jPQ2IAeZRCYxpS/Cm1495vGFww6ecHmMk1YJH2Q5ln0=
@@ -246,6 +268,8 @@ github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3
 github.com/containerd/nri v0.0.0-20201007170849-eb1350a75164/go.mod h1:+2wGSDGFYfE5+So4M5syatU0N0f0LbWpuqyMi4/BE8c=
 github.com/containerd/nri v0.0.0-20210316161719-dbaa18c31c14/go.mod h1:lmxnXF6oMkbqs39FiCt1s0R2HSMhcLel9vNL3m4AaeY=
 github.com/containerd/nri v0.1.0/go.mod h1:lmxnXF6oMkbqs39FiCt1s0R2HSMhcLel9vNL3m4AaeY=
+github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpSBQv6A=
+github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
 github.com/containerd/stargz-snapshotter/estargz v0.4.1/go.mod h1:x7Q9dg9QYb4+ELgxmo4gBUeJB0tl5dqH1Sdz0nJU1QM=
 github.com/containerd/stargz-snapshotter/estargz v0.11.0/go.mod h1:/KsZXsJRllMbTKFfG0miFQWViQKdI9+9aSXs+HN0+ac=
 github.com/containerd/ttrpc v0.0.0-20190828154514-0e0f228740de/go.mod h1:PvCDdDGpgqzQIzDW1TphrGLssLDZp2GuS+X5DkEJB8o=
@@ -292,9 +316,10 @@ github.com/coreos/pkg v0.0.0-20160727233714-3ac0863d7acf/go.mod h1:E3G3o1h8I7cfc
 github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
 github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
-github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/cpuguy83/go-md2man/v2 v2.0.6 h1:XJtiaUW6dEEqVuZiMTn1ldk455QWwEIsMIJlo5vtkx0=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
+github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/creack/pty v1.1.17/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
@@ -302,8 +327,6 @@ github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
 github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
 github.com/cyphar/filepath-securejoin v0.2.2/go.mod h1:FpkQEhXnPnOthhzymB7CGsFk2G9VLXONKD9G7QGMM+4=
 github.com/cyphar/filepath-securejoin v0.2.3/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
-github.com/cyphar/filepath-securejoin v0.3.6 h1:4d9N5ykBnSp5Xn2JkhocYDkOpURL/18CYMpo6xB9uWM=
-github.com/cyphar/filepath-securejoin v0.3.6/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
 github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s=
 github.com/cyphar/filepath-securejoin v0.4.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
 github.com/d2g/dhcp4 v0.0.0-20170904100407-a1d1b6c41b1c/go.mod h1:Ct2BUK8SB0YC1SMSibvLzxjeJLnrYEVLULFNiHY9YfQ=
@@ -324,23 +347,21 @@ github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5Qvfr
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/dnaeon/go-vcr v1.0.1/go.mod h1:aBB1+wY4s93YsC3HHjMBMrwTj2R9FHDzUr9KyGc8n1E=
 github.com/docker/cli v0.0.0-20191017083524-a8ff7f821017/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/cli v27.4.1+incompatible h1:VzPiUlRJ/xh+otB75gva3r05isHMo5wXDfPRi5/b4hI=
-github.com/docker/cli v27.4.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/cli v28.0.1+incompatible h1:g0h5NQNda3/CxIsaZfH4Tyf6vpxFth7PYl3hgCPOKzs=
 github.com/docker/cli v28.0.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v28.3.3+incompatible h1:fp9ZHAr1WWPGdIWBM1b3zLtgCF+83gRdVMTJsUeiyAo=
+github.com/docker/cli v28.3.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v0.0.0-20190905152932-14b96e55d84c/go.mod h1:0+TTO4EOBfRPhZXAeF1Vu+W3hHZ8eLp8PgKVZlcvtFY=
 github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker v1.4.2-0.20190924003213-a8608b5b67c7/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker v27.4.1+incompatible h1:ZJvcY7gfwHn1JF48PfbyXg7Jyt9ZCWDW+GGXOIxEwp4=
-github.com/docker/docker v27.4.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker v28.0.1+incompatible h1:FCHjSRdXhNRFjlHMTv4jUNlIBbTeRjrWfeFuJp7jpo0=
 github.com/docker/docker v28.0.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v28.3.3+incompatible h1:Dypm25kh4rmk49v1eiVbsAtpAsYURjYkaKubwuBdxEI=
+github.com/docker/docker v28.3.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.6.3/go.mod h1:WRaJzqw3CTB9bk10avuGsjVBZsD05qeibJ1/TYlvc0Y=
-github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
-github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
 github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
 github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
 github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c h1:lzqkGL9b3znc+ZUgi7FlLnqjQhcXxkNM/quxIjBVMD0=
@@ -348,6 +369,8 @@ github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c/go.mod h1:CADgU4DSXK
 github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
 github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
 github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
+github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
+github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
 github.com/docker/go-events v0.0.0-20170721190031-9461782956ad/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
 github.com/docker/go-metrics v0.0.0-20180209012529-399ea8c73916/go.mod h1:/u0gXw0Gay3ceNrsHubL3BtdOL2fHf93USgMTe0W5dI=
@@ -365,9 +388,8 @@ github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4/go.mod h1:Htrtb
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/dvsekhvalnov/jose2go v0.0.0-20170216131308-f21a8cedbbae/go.mod h1:7BvyPhdbLxMXIYTFPLsyJRFMsKmOZnQmzh6Gb+uquuM=
 github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
-github.com/elazarl/goproxy v1.2.3 h1:xwIyKHbaP5yfT6O9KIeYJR5549MXRQkoQMRXGztz8YQ=
-github.com/elazarl/goproxy v1.2.3/go.mod h1:YfEbZtqP4AetfO6d40vWchF3znWX7C7Vd6ZMfdL8z64=
 github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o=
+github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE=
 github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
 github.com/emicklei/go-restful v2.9.5+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
@@ -378,6 +400,8 @@ github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1m
 github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4=
+github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM=
 github.com/erikstmartin/go-testdb v0.0.0-20160219214506-8d10e4a1bae5/go.mod h1:a2zkGnVExMxdzMo3M0Hi/3sEU+cWnZpSni0O6/Yb/P0=
 github.com/evanphx/json-patch v4.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
@@ -402,16 +426,14 @@ github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
 github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
-github.com/go-git/go-billy/v5 v5.6.1 h1:u+dcrgaguSSkbjzHwelEjc0Yj300NUevrrPphk/SoRA=
-github.com/go-git/go-billy/v5 v5.6.1/go.mod h1:0AsLr1z2+Uksi4NlElmMblP5rPcDZNRCD8ujZCRR2BE=
 github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UNbRM=
 github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.13.1 h1:DAQ9APonnlvSWpvolXWIuV6Q6zXy2wHbN4cVlNR5Q+M=
-github.com/go-git/go-git/v5 v5.13.1/go.mod h1:qryJB4cSBoq3FRoBRf5A77joojuBcmPJ0qu3XXXVixc=
 github.com/go-git/go-git/v5 v5.14.0 h1:/MD3lCrGjCen5WfEAzKg00MJJffKhC8gzS80ycmCi60=
 github.com/go-git/go-git/v5 v5.14.0/go.mod h1:Z5Xhoia5PcWA3NF8vRLURn9E5FRhSl7dGj9ItW3Wk5k=
+github.com/go-git/go-git/v5 v5.16.2 h1:fT6ZIOjE5iEnkzKyxTHK1W4HGAsPhqEqiSAssSO77hM=
+github.com/go-git/go-git/v5 v5.16.2/go.mod h1:4Ge4alE/5gPs30F2H1esi2gPd69R0C39lolkucHBOp8=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -427,6 +449,8 @@ github.com/go-logr/logr v0.2.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTg
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-openapi/jsonpointer v0.0.0-20160704185906-46af16f9f7b1/go.mod h1:+35s3my2LFTysnkMfxsJBAMHj/DoqoB9knIWoYG/Vk0=
@@ -445,6 +469,8 @@ github.com/go-sql-driver/mysql v1.3.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-viper/mapstructure/v2 v2.2.1 h1:ZAaOCxANMuZx5RCeg0mBdEZk7DZasvvZIxtHqx8aGss=
 github.com/go-viper/mapstructure/v2 v2.2.1/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
+github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/godbus/dbus v0.0.0-20151105175453-c7fdd8b5cd55/go.mod h1:/YcGZj5zSblfDWMMoOzV4fas9FZnQYTkDnsGvmh2Grw=
 github.com/godbus/dbus v0.0.0-20180201030542-885f9cc04c9c/go.mod h1:/YcGZj5zSblfDWMMoOzV4fas9FZnQYTkDnsGvmh2Grw=
 github.com/godbus/dbus v0.0.0-20190422162347-ade71ed3457e/go.mod h1:bBOAhwG1umN6/6ZUMtDFBMQR8jRg9O75tm9K00oMsK4=
@@ -508,8 +534,6 @@ github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-containerregistry v0.5.1/go.mod h1:Ct15B4yir3PLOP5jsy0GNeYVaIZs/MK/Jz5any1wFW0=
@@ -553,10 +577,10 @@ github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t
 github.com/grpc-ecosystem/grpc-gateway v1.9.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0 h1:gmcG1KaJ57LophUzW0Hy8NmPhnMZb4M0+kPpLofRdBo=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.25.1 h1:VNqngBF40hVlDloBruUehVYC3ArSgIyScOAyMRqBxRg=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.25.1/go.mod h1:RBRO7fro65R6tjKzYgLAFo0t1QEXY1Dp+i/bvpRiqiQ=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 h1:5ZPtiqj0JL5oKWmcsq4VMaAW5ukBEgSGXEN89zeH1Jo=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3/go.mod h1:ndYquD05frm2vACXE1nsccT4oJzjhw2arTS2cpUD1PI=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 h1:X5VWvz21y3gzm9Nw/kaUeku/1+uBhcekkmy4IkffJww=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1/go.mod h1:Zanoh4+gvIgluNqcfMVTJueD4wSS5hT7zTt4Mrutd90=
 github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed h1:5upAirOpQc1Q53c0bnx2ufif5kANL7bfZWcc6VJWJd8=
 github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed/go.mod h1:tMWxXQ9wFIaZeTI9F+hmhFiGpFmhOHzyShyFUhRm0H4=
 github.com/hashicorp/errwrap v0.0.0-20141028054710-7554cd9344ce/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -570,6 +594,8 @@ github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHh
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISHxT2Q8+VepXU=
 github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk=
+github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
+github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
@@ -618,8 +644,6 @@ github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+o
 github.com/klauspost/compress v1.11.3/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
 github.com/klauspost/compress v1.11.13/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
 github.com/klauspost/compress v1.14.2/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
-github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
-github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
 github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
 github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
 github.com/klauspost/pgzip v1.2.5/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
@@ -639,6 +663,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/leonelquinteros/gotext v1.7.2 h1:bDPndU8nt+/kRo1m4l/1OXiiy2v7Z7dfPQ9+YP7G1Mc=
+github.com/leonelquinteros/gotext v1.7.2/go.mod h1:9/haCkm5P7Jay1sxKDGJ5WIg4zkz8oZKw4ekNpALob8=
 github.com/lib/pq v0.0.0-20150723085316-0dad96c0b94f/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/linuxkit/virtsock v0.0.0-20201010232012-f8cee7dfc7a3/go.mod h1:3r6x7q95whyfWQpmGZTu3gk3v2YkMi05HEzl7Tf7YEo=
 github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
@@ -653,15 +679,14 @@ github.com/mailru/easyjson v0.7.0/go.mod h1:KAzv3t3aY1NaHWoQz1+4F1ccyAH66Jk7yos7
 github.com/marstr/guid v1.1.0/go.mod h1:74gB1z2wpxxInTG6yaqA7KrtM0NZ+RbrcqDvYHefzho=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
 github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
-github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
-github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=
+github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
 github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
 github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
@@ -688,18 +713,22 @@ github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/osext v0.0.0-20151018003038-5e2d6d41470f/go.mod h1:OkQIRizQZAeMln+1tSwduZz7+Af5oFlKirV/MSYes2A=
-github.com/mmcloughlin/avo v0.6.0 h1:QH6FU8SKoTLaVs80GA8TJuLNkUYl4VokHKlPhVDg4YY=
-github.com/mmcloughlin/avo v0.6.0/go.mod h1:8CoAGaCSYXtCPR+8y18Y9aB/kxb8JSS6FRI7mSkvD+8=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
+github.com/moby/go-archive v0.1.0 h1:Kk/5rdW/g+H8NHdJW2gsXyZ7UnzvJNOy6VKJqueWdcQ=
+github.com/moby/go-archive v0.1.0/go.mod h1:G9B+YoujNohJmrIYFBpSd54GTUB4lt9S+xVQvsJyFuo=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
 github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk=
 github.com/moby/patternmatcher v0.6.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
+github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
+github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs=
 github.com/moby/sys/mountinfo v0.4.0/go.mod h1:rEr8tzG/lsIZHBtN/JjGG+LMYx9eXgW2JI+6q0qou+A=
 github.com/moby/sys/mountinfo v0.4.1/go.mod h1:rEr8tzG/lsIZHBtN/JjGG+LMYx9eXgW2JI+6q0qou+A=
 github.com/moby/sys/mountinfo v0.5.0/go.mod h1:3bMD3Rg+zkqx8MRYPi7Pyb0Ie97QEBmdxbhnCLlSvSU=
 github.com/moby/sys/mountinfo v0.6.2 h1:BzJjoreD5BMFNmD9Rus6gdd1pLuecOFPt8wC+Vygl78=
 github.com/moby/sys/mountinfo v0.6.2/go.mod h1:IJb6JQeOklcdMU9F5xQ8ZALD+CUr5VlGpwtX+VE0rpI=
+github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=
+github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4=
 github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
 github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
 github.com/moby/sys/signal v0.7.1 h1:PrQxdvxcGijdo6UXXo/lU/TvHUWyPhj7UOpSo8tuvk0=
@@ -707,11 +736,11 @@ github.com/moby/sys/signal v0.7.1/go.mod h1:Se1VGehYokAkrSQwL4tDzHvETwUZlnY7S5Xt
 github.com/moby/sys/symlink v0.1.0/go.mod h1:GGDODQmbFOjFsXvfLVn3+ZRxkch54RkSiGqsZeMYowQ=
 github.com/moby/sys/user v0.3.0 h1:9ni5DlcW5an3SvRSx4MouotOygvzaXbaSrc/wGDFWPo=
 github.com/moby/sys/user v0.3.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
+github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
+github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
 github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
 github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/moby/term v0.0.0-20200312100748-672ec06f55cd/go.mod h1:DdlQx2hp0Ss5/fLikoLlEeIYiATotOjgB//nb973jeo=
-github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
-github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
 github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
 github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -722,8 +751,10 @@ github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjY
 github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/mrunalp/fileutils v0.5.0/go.mod h1:M1WthSahJixYnrXQl/DFQuteStB1weuxD2QJNHXfbSQ=
-github.com/muesli/termenv v0.15.2 h1:GohcuySI0QmI3wN8Ok9PtKGkgkFIk7y6Vpb5PvrY+Wo=
-github.com/muesli/termenv v0.15.2/go.mod h1:Epx+iuz8sNs7mNKhxzH4fWXGNpZwUaJKRS1noLXviQ8=
+github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=
+github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6/go.mod h1:CJlz5H+gyd6CUWT45Oy4q24RdLyn7Md9Vj2/ldJBSIo=
+github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
+github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
 github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=
 github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
 github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
@@ -762,8 +793,6 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.0.0/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
 github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
-github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
-github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
 github.com/opencontainers/runc v0.0.0-20190115041553-12f6a991201f/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
@@ -795,10 +824,10 @@ github.com/pelletier/go-toml v1.8.1/go.mod h1:T2/BmBdy8dvIRq1a/8aqjN41wvWlN4lrap
 github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
 github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
-github.com/pjbgf/sha1cd v0.3.1 h1:Dh2GYdpJnO84lIw0LJwTFXjcNbasP/bklicSznyAaPI=
-github.com/pjbgf/sha1cd v0.3.1/go.mod h1:Y8t7jSB/dEI/lQE04A1HVKteqjj9bX5O4+Cex0TCu8s=
 github.com/pjbgf/sha1cd v0.3.2 h1:a9wb0bp1oC2TGwStyn0Umc/IGKQnEgF0vVaZ8QF8eo4=
 github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A=
+github.com/pjbgf/sha1cd v0.4.0 h1:NXzbL1RvjTUi6kgYZCX3fPwwl27Q1LJndxtUDVfJGRY=
+github.com/pjbgf/sha1cd v0.4.0/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1-0.20171018195549-f15c970de5b7/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -814,10 +843,10 @@ github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDf
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQP1xR9D75/vuwEF3g=
 github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
-github.com/prometheus/client_golang v1.20.5 h1:cxppBPuYhUnsO6yo/aoRol4L7q7UFfdm+bR9r+8l63Y=
-github.com/prometheus/client_golang v1.20.5/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
 github.com/prometheus/client_golang v1.21.1 h1:DOvXXTqVzvkIewV/CDPFdejpMCGeMcbGCQ8YOmu+Ibk=
 github.com/prometheus/client_golang v1.21.1/go.mod h1:U9NM32ykUErtVBxdvD3zfi+EuFkkaBvMb09mIfe0Zgg=
+github.com/prometheus/client_golang v1.23.0 h1:ust4zpdl9r4trLY/gSjlm07PuiBq2ynaXXlptpfy8Uc=
+github.com/prometheus/client_golang v1.23.0/go.mod h1:i/o0R9ByOnHX0McrTMTyhYvKE4haaf2mW08I+jGAjEE=
 github.com/prometheus/client_model v0.0.0-20171117100541-99fa1f4be8e5/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
@@ -825,16 +854,18 @@ github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:
 github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
 github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
 github.com/prometheus/common v0.0.0-20180110214958-89604d197083/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.6.0/go.mod h1:eBmuwkDJBwy6iBfxCBob6t6dR6ENT/y+J+Zk0j9GMYc=
 github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
-github.com/prometheus/common v0.61.0 h1:3gv/GThfX0cV2lpO7gkTUwZru38mxevy90Bj8YFSRQQ=
-github.com/prometheus/common v0.61.0/go.mod h1:zr29OCN/2BsJRaFwG8QOBr41D6kkchKbpeNH7pAjb/s=
 github.com/prometheus/common v0.63.0 h1:YR/EIY1o3mEFP/kZCD7iDMnLPlGyuU2Gb3HIcXnA98k=
 github.com/prometheus/common v0.63.0/go.mod h1:VVFF/fBIoToEnWRVkYoXEkq3R3paCoxG9PXP74SnV18=
+github.com/prometheus/common v0.65.0 h1:QDwzd+G1twt//Kwj/Ww6E9FQq1iVMmODnILtW1t2VzE=
+github.com/prometheus/common v0.65.0/go.mod h1:0gZns+BLRQ3V6NdaerOhMbwwRbNh9hkGINtQAsP5GS8=
 github.com/prometheus/procfs v0.0.0-20180125133057-cb4147076ac7/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
@@ -848,6 +879,8 @@ github.com/prometheus/procfs v0.2.0/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4O
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
 github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
+github.com/prometheus/procfs v0.17.0 h1:FuLQ+05u4ZI+SS/w9+BWEM2TXiHKsUQ9TADiRH7DuK0=
+github.com/prometheus/procfs v0.17.0/go.mod h1:oPQLaDAMRbA+u8H5Pbfq+dl3VDAvHxMUOVhe0wYB2zw=
 github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
@@ -855,18 +888,14 @@ github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUc
 github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
-github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday v1.6.0 h1:KqfZb0pUVN2lYqZUYRddxF4OR8ZMURnJIG5Y3VRLtww=
-github.com/russross/blackfriday v1.6.0/go.mod h1:ti0ldHuxg49ri4ksnFxlkCfN+hvslNlmVHqNRXXJNAY=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/safchain/ethtool v0.0.0-20190326074333-42ed695e3de8/go.mod h1:Z0q5wiBQGYcxhMZ6gUqHn6pYNLypFAvaL3UvgZLR0U4=
 github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
-github.com/schollz/progressbar/v3 v3.17.1 h1:bI1MTaoQO+v5kzklBjYNRQLoVpe0zbyRZNK6DFkVC5U=
-github.com/schollz/progressbar/v3 v3.17.1/go.mod h1:RzqpnsPQNjUyIgdglUjRLgD7sVnxN1wpmBMV+UiEbL4=
 github.com/schollz/progressbar/v3 v3.18.0 h1:uXdoHABRFmNIjUfte/Ex7WtuyVslrw2wVPQmCN62HpA=
 github.com/schollz/progressbar/v3 v3.18.0/go.mod h1:IsO3lpbaGuzh8zIMzgY3+J8l4C8GjO0Y9S69eFvNsec=
 github.com/sclevine/spec v1.2.0/go.mod h1:W4J29eT/Kzv7/b9IWLB055Z+qvVC9vt0Arko24q7p+U=
@@ -874,6 +903,8 @@ github.com/seccomp/libseccomp-golang v0.9.1/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvW
 github.com/seccomp/libseccomp-golang v0.9.2-0.20210429002308-3879420cc921/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg=
 github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
 github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
+github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
+github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/sirupsen/logrus v1.0.4-0.20170822132746-89742aefa4b2/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
 github.com/sirupsen/logrus v1.0.6/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
@@ -885,8 +916,6 @@ github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic
 github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/skeema/knownhosts v1.3.0 h1:AM+y0rI04VksttfwjkSTNQorvGqmwATnvnAHpSgc0LY=
-github.com/skeema/knownhosts v1.3.0/go.mod h1:sPINvnADmT/qYH1kfv+ePMmOBTH6Tbl7b5LvTDjFK7M=
 github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnBY8=
 github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
@@ -903,8 +932,6 @@ github.com/spf13/cobra v0.0.1/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3
 github.com/spf13/cobra v0.0.2-0.20171109065643-2da4a54c5cee/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
 github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
 github.com/spf13/cobra v1.0.0/go.mod h1:/6GTrnGXV9HjY+aR4k0oJ5tcvakLuG6EuKReYlHNrgE=
-github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
-github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
 github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
 github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
 github.com/spf13/jwalterweatherman v0.0.0-20141219030609-3d60171a6431/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
@@ -915,10 +942,11 @@ github.com/spf13/pflag v1.0.0/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnIn
 github.com/spf13/pflag v1.0.1-0.20171106142849-4c012f6dcd95/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.1/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
 github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
+github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v0.0.0-20150530192845-be5ff3e4840c/go.mod h1:A8kyI5cUJhb8N+3pkfONlcEcZbueH6nhAm0Fq7SrnBM=
 github.com/spf13/viper v1.4.0 h1:yXHLWeravcrgGyFSyCgdYpXQ9dR9c/WED3pg1RhxqEU=
 github.com/spf13/viper v1.4.0/go.mod h1:PTJ7Z/lr49W6bUbkmS1V3by4uWynFiR9p7+dSq/yZzE=
@@ -995,49 +1023,49 @@ go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
 go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 h1:yd02MEjBdJkG3uabWP9apV+OuWRIXGDuJEUJbOHmCFU=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0/go.mod h1:umTcuxiv1n/s/S6/c2AT/g2CQ7u5C59sHDNmfSwgz7Q=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 h1:sbiXRNDSWJOTobXh5HyQKjq6wUC5tNybqjIqDpAY4CU=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0/go.mod h1:69uWxva0WgAA/4bu2Yy70SLDBwZXuQ6PbBpbsa5iZrQ=
-go.opentelemetry.io/otel v1.33.0 h1:/FerN9bax5LoK51X/sI0SVYrjSE0/yUL7DpxW4K3FWw=
-go.opentelemetry.io/otel v1.33.0/go.mod h1:SUUkR6csvUQl+yjReHu5uM3EtVV7MBm5FHKRlNx4I8I=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0 h1:Hf9xI/XLML9ElpiHVDNwvqI0hIFlzV8dgIr35kV1kRU=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0/go.mod h1:NfchwuyNoMcZ5MLHwPrODwUF1HWCXWrL31s8gSAdIKY=
 go.opentelemetry.io/otel v1.35.0 h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ=
 go.opentelemetry.io/otel v1.35.0/go.mod h1:UEqy8Zp11hpkUrL73gSlELM0DupHoiq72dR+Zqel/+Y=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.33.0 h1:7F29RDmnlqk6B5d+sUqemt8TBfDqxryYW5gX6L74RFA=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.33.0/go.mod h1:ZiGDq7xwDMKmWDrN1XsXAj0iC7hns+2DhxBFSncNHSE=
+go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
+go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.35.0 h1:QcFwRrZLc82r8wODjvyCbP7Ifp3UANaBSmhDSFjnqSc=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.35.0/go.mod h1:CXIWhUomyWBG/oY2/r/kLp6K/cmx9e/7DLpBuuGdLCA=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0 h1:Vh5HayB/0HHfOQA7Ctx69E/Y/DcQSMPpKANYVMQ7fBA=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0/go.mod h1:cpgtDBaqD/6ok/UG0jT15/uKjAY8mRA53diogHBg3UI=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.37.0 h1:zG8GlgXCJQd5BU98C0hZnBbElszTmUgCNCfYneaDL0A=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.37.0/go.mod h1:hOfBCz8kv/wuq73Mx2H2QnWokh/kHZxkh6SNF2bdKtw=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 h1:1fTNlAIJZGWLP5FVu0fikVry1IsiUnXjf7QFvoNN3Xw=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0/go.mod h1:zjPK58DtkqQFn+YUMbx0M2XV3QgKU0gS9LeGohREyK4=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0 h1:5pojmb1U1AogINhN3SurB+zm/nIcusopeBNp42f45QM=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0/go.mod h1:57gTHJSE5S1tqg+EKsLPlTWhpHMsWlVmer+LA926XiA=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 h1:Ahq7pZmv87yiyn3jeFz/LekZmPLLdKejuO3NcK9MssM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0/go.mod h1:MJTqhM0im3mRLw1i8uGHnCvUEeS7VwRyxlLC78PA18M=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0 h1:m639+BofXTvcY1q8CGs4ItwQarYtJPOWmVobfM1HpVI=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0/go.mod h1:LjReUci/F4BUyv+y4dwnq3h/26iNOeC3wAIqgvTIZVo=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 h1:EtFWSnwW9hGObjkIdmlnWSydO+Qs8OwzfzXLUPg4xOc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0/go.mod h1:QjUEoiGCPkvFZ/MjK6ZZfNOS6mfVEVKYE99dFhuN2LI=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0 h1:IeMeyr1aBvBiPVYihXIaeIZba6b8E1bYp7lbdxK8CQg=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0/go.mod h1:oVdCUtjq9MK9BlS7TtucsQwUcXcymNiEDjgDD2jMtZU=
-go.opentelemetry.io/otel/metric v1.33.0 h1:r+JOocAyeRVXD8lZpjdQjzMadVZp2M4WmQ+5WtEnklQ=
-go.opentelemetry.io/otel/metric v1.33.0/go.mod h1:L9+Fyctbp6HFTddIxClbQkjtubW6O9QS3Ann/M82u6M=
 go.opentelemetry.io/otel/metric v1.35.0 h1:0znxYu2SNyuMSQT4Y9WDWej0VpcsxkuklLa4/siN90M=
 go.opentelemetry.io/otel/metric v1.35.0/go.mod h1:nKVFgxBZ2fReX6IlyW28MgZojkoAkJGaE8CpgeAU3oE=
-go.opentelemetry.io/otel/sdk v1.33.0 h1:iax7M131HuAm9QkZotNHEfstof92xM+N8sr3uHXc2IM=
-go.opentelemetry.io/otel/sdk v1.33.0/go.mod h1:A1Q5oi7/9XaMlIWzPSxLRWOI8nG3FnzHJNbiENQuihM=
+go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
+go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
 go.opentelemetry.io/otel/sdk v1.35.0 h1:iPctf8iprVySXSKJffSS79eOjl9pvxV9ZqOWT0QejKY=
 go.opentelemetry.io/otel/sdk v1.35.0/go.mod h1:+ga1bZliga3DxJ3CQGg3updiaAJoNECOgJREo9KHGQg=
-go.opentelemetry.io/otel/sdk/metric v1.33.0 h1:Gs5VK9/WUJhNXZgn8MR6ITatvAmKeIuCtNbsP3JkNqU=
-go.opentelemetry.io/otel/sdk/metric v1.33.0/go.mod h1:dL5ykHZmm1B1nVRk9dDjChwDmt81MjVp3gLkQRwKf/Q=
+go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
+go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg=
 go.opentelemetry.io/otel/sdk/metric v1.35.0 h1:1RriWBmCKgkeHEhM7a2uMjMUfP7MsOF5JpUCaEqEI9o=
 go.opentelemetry.io/otel/sdk/metric v1.35.0/go.mod h1:is6XYCUMpcKi+ZsOvfluY5YstFnhW0BidkR+gL+qN+w=
-go.opentelemetry.io/otel/trace v1.33.0 h1:cCJuF7LRjUFso9LPnEAHJDB2pqzp+hbO8eu1qqW2d/s=
-go.opentelemetry.io/otel/trace v1.33.0/go.mod h1:uIcdVUZMpTAmz0tI1z04GoVSezK37CbGV4fr1f2nBck=
+go.opentelemetry.io/otel/sdk/metric v1.37.0 h1:90lI228XrB9jCMuSdA0673aubgRobVZFhbjxHHspCPc=
+go.opentelemetry.io/otel/sdk/metric v1.37.0/go.mod h1:cNen4ZWfiD37l5NhS+Keb5RXVWZWpRE+9WyVCpbo5ps=
 go.opentelemetry.io/otel/trace v1.35.0 h1:dPpEfJu1sDIqruz7BHFG3c7528f6ddfSWfFDVt/xgMs=
 go.opentelemetry.io/otel/trace v1.35.0/go.mod h1:WUk7DtFp1Aw2MkvqGdwiXYDZZNvA/1J8o6xRXLrIkyc=
+go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
+go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.opentelemetry.io/proto/otlp v1.4.0 h1:TA9WRvW6zMwP+Ssb6fLoUIuirti1gGbP28GcKG1jgeg=
-go.opentelemetry.io/proto/otlp v1.4.0/go.mod h1:PPBWZIP98o2ElSqI35IHfu7hIhSwvc5N38Jw8pXuGFY=
 go.opentelemetry.io/proto/otlp v1.5.0 h1:xJvq7gMzB31/d406fB8U5CBdyQGw4P399D1aQWU/3i4=
 go.opentelemetry.io/proto/otlp v1.5.0/go.mod h1:keN8WnHxOy8PG0rQZjJJ5A2ebUoafqWp0eVQ4yIXvJ4=
+go.opentelemetry.io/proto/otlp v1.7.1 h1:gTOMpGDb0WTBOP8JaO72iL3auEZhVmAQg4ipjOVAtj4=
+go.opentelemetry.io/proto/otlp v1.7.1/go.mod h1:b2rVh6rfI/s2pHWNlB7ILJcRALpcNDzKhACevjI+ZnE=
 go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
@@ -1062,12 +1090,10 @@ golang.org/x/crypto v0.0.0-20201117144127-c1f2f97bffc9/go.mod h1:jdWPYTVW3xRLrWP
 golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
-golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.32.0 h1:euUpcYgM8WcP71gNpTqQCn6rC2t6ULUPiOzfWaXVVfc=
-golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
 golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
 golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
+golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
+golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -1078,12 +1104,12 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20250103183323-7d7fa50e5329 h1:9kj3STMvgqy3YA4VQXBrN7925ICMxD5wzMRcgA30588=
-golang.org/x/exp v0.0.0-20250103183323-7d7fa50e5329/go.mod h1:qj5a5QZpwLU2NLQudwIN5koi3beDhSAlJwa67PuM98c=
-golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8 h1:yqrTHse8TCMW1M1ZCP+VAR/l0kKxwaAIqN/il7x4voA=
-golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8/go.mod h1:tujkw807nyEEAamNbDrEGzRav+ilXA7PCRAd6xsmwiU=
 golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 h1:nDVHiLt8aIbd/VzvPWN6kSOPE7+F/fNFDSXLVYkE/Iw=
 golang.org/x/exp v0.0.0-20250305212735-054e65f0b394/go.mod h1:sIifuuw/Yco/y6yb6+bDNfyeQ/MdPUy/hKEMYQV17cM=
+golang.org/x/exp v0.0.0-20250811191247-51f88131bc50 h1:3yiSh9fhy5/RhCSntf4Sy0Tnx50DmMpQ4MQdKKk4yg4=
+golang.org/x/exp v0.0.0-20250811191247-51f88131bc50/go.mod h1:rT6SFzZ7oxADUDx58pcaKFTcZ+inxAa9fTrYx/uVYwg=
+golang.org/x/exp v0.0.0-20250813145105-42675adae3e6 h1:SbTAbRFnd5kjQXbczszQ0hdk3ctwYf3qBNH9jIsGclE=
+golang.org/x/exp v0.0.0-20250813145105-42675adae3e6/go.mod h1:4QTo5u+SEIbbKW1RacMZq1YEfOBqeXa19JeshGi+zc4=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -1106,10 +1132,6 @@ golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.22.0 h1:D4nJWe9zXqHOmWqj4VMOJhvzj7bEZg4wEYa759z1pH4=
-golang.org/x/mod v0.22.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
-golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
-golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1151,12 +1173,10 @@ golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96b
 golang.org/x/net v0.0.0-20210825183410-e898025ed96a/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
-golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
-golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
 golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c=
 golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
+golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
+golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1174,10 +1194,10 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
-golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
 golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
+golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1247,6 +1267,7 @@ golang.org/x/sys v0.0.0-20210426230700-d19ff857e887/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210906170528-6f6e22806c34/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211116061358-0a5406a5449c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -1254,24 +1275,19 @@ golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
-golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
-golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
 golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
+golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
-golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.28.0 h1:/Ts8HFuMR2E6IP/jlo7QVLZHggjKQbhu/7H0LJFr3Gg=
-golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
 golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
 golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
+golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
+golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1281,22 +1297,20 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
-golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
 golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
 golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
+golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.8.0 h1:9i3RxcPv3PZnitoVGMPDKZSq1xW1gK1Xy3ArNOGZfEg=
-golang.org/x/time v0.8.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
-golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
-golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
 golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20181011042414-1f849cf54d09/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -1342,12 +1356,6 @@ golang.org/x/tools v0.0.0-20200916195026-c9a70fc28ce3/go.mod h1:z6u4i615ZeAfBE4X
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.28.0 h1:WuB6qZ4RPCQo5aP3WdKZS7i595EdWqWR8vqJTlwTVK8=
-golang.org/x/tools v0.28.0/go.mod h1:dcIOrVd3mfQKTgrDVQHqCPMWy6lnhfhtX3hLXYVLfRw=
-golang.org/x/tools v0.29.0 h1:Xx0h3TtM9rzQpQuR4dKLrdglAmCEN5Oi+P74JdhdzXE=
-golang.org/x/tools v0.29.0/go.mod h1:KMQVMRsVxU6nHCFXrBPhDB8XncLNLM0lIy/F14RP588=
-golang.org/x/tools v0.31.0 h1:0EedkvKDbh+qistFTd0Bcwe/YLh4vHwWEkiI0toFIBU=
-golang.org/x/tools v0.31.0/go.mod h1:naFTU+Cev749tSJRXJlna0T3WxKvb1kWEx15xA4SdmQ=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1396,18 +1404,14 @@ google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfG
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
 google.golang.org/genproto v0.0.0-20200527145253-8367513e4ece/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
 google.golang.org/genproto v0.0.0-20201110150050-8816d57aaa9a/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto/googleapis/api v0.0.0-20250102185135-69823020774d h1:H8tOf8XM88HvKqLTxe755haY6r1fqqzLbEnfrmLXlSA=
-google.golang.org/genproto/googleapis/api v0.0.0-20250102185135-69823020774d/go.mod h1:2v7Z7gP2ZUOGsaFyxATQSRoBnKygqVq2Cwnvom7QiqY=
-google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422 h1:GVIKPyP/kLIyVOgOnTwFOrvQaQUzOzGMCxgFUOEmm24=
-google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422/go.mod h1:b6h1vNKhxaSoEI+5jc3PJUCustfli/mRab7295pY7rw=
 google.golang.org/genproto/googleapis/api v0.0.0-20250313205543-e70fdf4c4cb4 h1:IFnXJq3UPB3oBREOodn1v1aGQeZYQclEmvWRMN0PSsY=
 google.golang.org/genproto/googleapis/api v0.0.0-20250313205543-e70fdf4c4cb4/go.mod h1:c8q6Z6OCqnfVIqUFJkCzKcrj8eCvUrz+K4KRzSTuANg=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d h1:xJJRGY7TJcvIlpSrN3K6LAWgNFUILlO+OMAqtg9aqnw=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d/go.mod h1:3ENsm/5D1mzDyhpzeRi1NR784I0BcofWBoSc5QqqMK4=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422 h1:3UsHvIr4Wc2aW4brOaSCmcxh9ksica6fHEr8P1XhkYw=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422/go.mod h1:3ENsm/5D1mzDyhpzeRi1NR784I0BcofWBoSc5QqqMK4=
+google.golang.org/genproto/googleapis/api v0.0.0-20250811230008-5f3141c8851a h1:DMCgtIAIQGZqJXMVzJF4MV8BlWoJh2ZuFiRdAleyr58=
+google.golang.org/genproto/googleapis/api v0.0.0-20250811230008-5f3141c8851a/go.mod h1:y2yVLIE/CSMCPXaHnSKXxu1spLPnglFLegmgdY23uuE=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250313205543-e70fdf4c4cb4 h1:iK2jbkWL86DXjEx0qiHcRE9dE4/Ahua5k6V8OWFb//c=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250313205543-e70fdf4c4cb4/go.mod h1:LuRYeWDFV6WOn90g357N17oMCaxpgCnbi/44qJvDn2I=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a h1:tPE/Kp+x9dMSwUm/uM0JKK0IfdiJkwAbSMSeZBXXJXc=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a/go.mod h1:gw1tLEfykwDz2ET4a12jcXt4couGAm7IwsVaTy0Sflo=
 google.golang.org/grpc v0.0.0-20160317175043-d3ddb4469d5a/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.0.5/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
@@ -1427,10 +1431,10 @@ google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTp
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
 google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.69.2 h1:U3S9QEtbXC0bYNvRtcoklF3xGtLViumSYxWykJS+7AU=
-google.golang.org/grpc v1.69.2/go.mod h1:vyjdE6jLBI76dgpDojsFGNaHlxdjXN9ghpnd2o7JGZ4=
 google.golang.org/grpc v1.71.0 h1:kF77BGdPTQ4/JZWMlb9VpJ5pa25aqvVqogsxNHHdeBg=
 google.golang.org/grpc v1.71.0/go.mod h1:H0GRtasmQOh9LkFoCPDu3ZrwUtD1YGE+b2vYBYd/8Ec=
+google.golang.org/grpc v1.74.2 h1:WoosgB65DlWVC9FqI82dGsZhWFNBSLjQ84bjROOpMu4=
+google.golang.org/grpc v1.74.2/go.mod h1:CtQ+BGjaAIXHs/5YS3i473GqwBBa1zGQNevxdeBEXrM=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -1444,12 +1448,10 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.36.1 h1:yBPeRvTftaleIgM3PZ/WBIZ7XM/eEYAaEyCwvyjq/gk=
-google.golang.org/protobuf v1.36.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
-google.golang.org/protobuf v1.36.2 h1:R8FeyR1/eLmkutZOM5CWghmo5itiG9z0ktFlTVLuTmU=
-google.golang.org/protobuf v1.36.2/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
 google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.7 h1:IgrO7UwFQGJdRNXH/sQux4R1Dj1WAKcLElzeeRaXV2A=
+google.golang.org/protobuf v1.36.7/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
 gopkg.in/airbrake/gobrake.v2 v2.0.9/go.mod h1:/h5ZAUhDkGaJfjzjKLSjv6zCL6O0LLBxU4K+aSYdM/U=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/cenkalti/backoff.v2 v2.2.1 h1:eJ9UAg01/HIHG987TwxvnzK2MgxXq97YY6rYDpY9aII=
@@ -1493,8 +1495,6 @@ gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
 gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
 gotest.tools/v3 v3.0.2/go.mod h1:3SzNCllyD9/Y+b5r9JIKQ474KzkZyqLqEfYqMsX94Bk=
 gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8=
-gotest.tools/v3 v3.5.1 h1:EENdUnS3pdur5nybKYIh2Vfgc8IUNBjxDPSjtiJcOzU=
-gotest.tools/v3 v3.5.1/go.mod h1:isy3WKz7GK6uNw/sbHzfKBLvlvXwUyV06n6brMxxopU=
 gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
 gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=

locales/default.pot

@@ -0,0 +1,12 @@
+msgid ""
+msgstr ""
+"Plural-Forms: nplurals=2; plural=(n != 1);\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Language: \n"
+"X-Generator: xgotext\n"
+
+#: app.go:11
+msgid "Manage apps"
+msgstr ""

locales/es/LC_MESSAGES/default.po

@@ -0,0 +1,20 @@
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: PACKAGE VERSION\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2025-08-04 14:15+0000\n"
+"PO-Revision-Date: 2025-08-04 14:15+0000\n"
+"Last-Translator: 3wordchant <3wc.coopcloud@doesthisthing.work>\n"
+"Language-Team: Spanish <https://translate.coopcloud.tech/projects/"
+"co-op-cloud/abra/es/>\n"
+"Language: es\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: ENCODING\n"
+"Plural-Forms: nplurals=2; plural=n != 1;\n"
+"X-Generator: Weblate 5.12.2\n"
+
+#: app.go:11
+msgid "Manage apps"
+msgstr "Gestionar aplicaciones"

pkg/app/app.go

@@ -426,7 +426,9 @@ func GetAppStatuses(apps []App, MachineReadable bool) (map[string]map[string]str
 	for server := range servers {
 		cl, err := client.New(server)
 		if err != nil {
-			return statuses, err
+			log.Warn(err)
+			ch <- stack.StackStatus{}
+			continue
 		}
 
 		go func(s string) {

pkg/client/configs.go

@@ -0,0 +1,38 @@
+package client
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/docker/docker/api/types/filters"
+	"github.com/docker/docker/api/types/swarm"
+	"github.com/docker/docker/client"
+)
+
+func GetConfigs(cl *client.Client, ctx context.Context, server string, fs filters.Args) ([]swarm.Config, error) {
+	configList, err := cl.ConfigList(ctx, swarm.ConfigListOptions{Filters: fs})
+	if err != nil {
+		return configList, err
+	}
+
+	return configList, nil
+}
+
+func GetConfigNames(configs []swarm.Config) []string {
+	var confNames []string
+
+	for _, conf := range configs {
+		confNames = append(confNames, conf.Spec.Name)
+	}
+
+	return confNames
+}
+
+func RemoveConfigs(cl *client.Client, ctx context.Context, configNames []string, force bool) error {
+	for _, confName := range configNames {
+		if err := cl.ConfigRemove(context.Background(), confName); err != nil {
+			return fmt.Errorf("conf %s: %s", confName, err)
+		}
+	}
+	return nil
+}

pkg/client/secret.go

@@ -7,7 +7,7 @@ import (
 	"github.com/docker/docker/client"
 )
 
-func StoreSecret(cl *client.Client, secretName, secretValue, server string) error {
+func StoreSecret(cl *client.Client, secretName, secretValue string) error {
 	ann := swarm.Annotations{Name: secretName}
 	spec := swarm.SecretSpec{Annotations: ann, Data: []byte(secretValue)}
 

pkg/config/abra.go

@@ -90,6 +90,7 @@ func (a Abra) GetAbraDir() string {
 
 func (a Abra) GetServersDir() string   { return path.Join(a.GetAbraDir(), "servers") }
 func (a Abra) GetRecipesDir() string   { return path.Join(a.GetAbraDir(), "recipes") }
+func (a Abra) GetLogsDir() string      { return path.Join(a.GetAbraDir(), "logs") }
 func (a Abra) GetVendorDir() string    { return path.Join(a.GetAbraDir(), "vendor") }
 func (a Abra) GetBackupDir() string    { return path.Join(a.GetAbraDir(), "backups") }
 func (a Abra) GetCatalogueDir() string { return path.Join(a.GetAbraDir(), "catalogue") }
@@ -100,6 +101,7 @@ var (
 	ABRA_DIR                  = config.GetAbraDir()
 	SERVERS_DIR               = config.GetServersDir()
 	RECIPES_DIR               = config.GetRecipesDir()
+	LOGS_DIR                  = config.GetLogsDir()
 	VENDOR_DIR                = config.GetVendorDir()
 	BACKUP_DIR                = config.GetBackupDir()
 	CATALOGUE_DIR             = config.GetCatalogueDir()

pkg/envfile/envfile.go

@@ -11,11 +11,6 @@ import (
 	"git.coopcloud.tech/toolshed/godotenv"
 )
 
-// envVarModifiers is a list of env var modifier strings. These are added to
-// env vars as comments and modify their processing by Abra, e.g. determining
-// how long secrets should be.
-var envVarModifiers = []string{"length"}
-
 // AppEnv is a map of the values in an apps env config
 type AppEnv = map[string]string
 

pkg/git/clone.go

@@ -1,7 +1,10 @@
 package git
 
 import (
+	"context"
+	"fmt"
 	"os"
+	"os/signal"
 	"strings"
 
 	"coopcloud.tech/abra/pkg/log"
@@ -22,46 +25,81 @@ func gitCloneIgnoreErr(err error) bool {
 	return false
 }
 
-// Clone runs a git clone which accounts for different default branches.
+// Clone runs a git clone which accounts for different default branches. This
+// function respects Ctrl+C (SIGINT) calls from the user, cancelling the
+// context and deleting the (typically) half-baked clone of the repository.
+// This avoids broken state for future clone / recipe ops.
 func Clone(dir, url string) error {
-	if _, err := os.Stat(dir); os.IsNotExist(err) {
-		log.Debugf("git clone: %s", dir, url)
+	ctx := context.Background()
+	ctx, cancelCtx := context.WithCancel(ctx)
 
-		_, err := git.PlainClone(dir, false, &git.CloneOptions{
-			URL:           url,
-			Tags:          git.AllTags,
-			ReferenceName: plumbing.ReferenceName("refs/heads/main"),
-			SingleBranch:  true,
-		})
+	sigIntCh := make(chan os.Signal, 1)
+	signal.Notify(sigIntCh, os.Interrupt)
+	defer func() {
+		signal.Stop(sigIntCh)
+		cancelCtx()
+	}()
 
-		if err != nil && gitCloneIgnoreErr(err) {
-			log.Debugf("git clone: %s cloned successfully", dir)
-			return nil
-		}
+	errCh := make(chan error)
 
-		if err != nil {
-			log.Debug("git clone: main branch failed, attempting master branch")
+	go func() {
+		if _, err := os.Stat(dir); os.IsNotExist(err) {
+			log.Debugf("git clone: %s", url)
 
-			_, err := git.PlainClone(dir, false, &git.CloneOptions{
+			_, err := git.PlainCloneContext(ctx, dir, false, &git.CloneOptions{
 				URL:           url,
 				Tags:          git.AllTags,
-				ReferenceName: plumbing.ReferenceName("refs/heads/master"),
+				ReferenceName: plumbing.ReferenceName("refs/heads/main"),
 				SingleBranch:  true,
 			})
 
 			if err != nil && gitCloneIgnoreErr(err) {
 				log.Debugf("git clone: %s cloned successfully", dir)
-				return nil
+				errCh <- nil
+			}
+
+			if err := ctx.Err(); err != nil {
+				errCh <- fmt.Errorf("git clone %s: cancelled due to interrupt", dir)
 			}
 
 			if err != nil {
-				return err
+				log.Debug("git clone: main branch failed, attempting master branch")
+
+				_, err := git.PlainCloneContext(ctx, dir, false, &git.CloneOptions{
+					URL:           url,
+					Tags:          git.AllTags,
+					ReferenceName: plumbing.ReferenceName("refs/heads/master"),
+					SingleBranch:  true,
+				})
+
+				if err != nil && gitCloneIgnoreErr(err) {
+					log.Debugf("git clone: %s cloned successfully", dir)
+					errCh <- nil
+				}
+
+				if err != nil {
+					errCh <- err
+				}
 			}
+
+			log.Debugf("git clone: %s cloned successfully", dir)
+		} else {
+			log.Debugf("git clone: %s already exists", dir)
 		}
 
-		log.Debugf("git clone: %s cloned successfully", dir)
-	} else {
-		log.Debugf("git clone: %s already exists", dir)
+		errCh <- nil
+	}()
+
+	select {
+	case <-sigIntCh:
+		cancelCtx()
+		fmt.Println() // NOTE(d1): newline after ^C
+		if err := os.RemoveAll(dir); err != nil {
+			return fmt.Errorf("unable to clean up git clone of %s: %s", dir, err)
+		}
+		return fmt.Errorf("git clone %s: cancelled due to interrupt", dir)
+	case err := <-errCh:
+		return err
 	}
 
 	return nil

pkg/git/clone_test.go

@@ -0,0 +1,48 @@
+package git
+
+import (
+	"fmt"
+	"os"
+	"path"
+	"syscall"
+	"testing"
+
+	"coopcloud.tech/abra/pkg/config"
+)
+
+func TestClone(t *testing.T) {
+	dir := path.Join(config.RECIPES_DIR, "gitea")
+	os.RemoveAll(dir)
+
+	gitURL := fmt.Sprintf("%s/%s.git", config.REPOS_BASE_URL, "gitea")
+	if err := Clone(dir, gitURL); err != nil {
+		t.Fatalf("unable to git clone gitea: %s", err)
+	}
+
+	if _, err := os.Stat(dir); err != nil && os.IsNotExist(err) {
+		t.Fatal("gitea repo was not cloned successfully")
+	}
+}
+
+func TestCancelGitClone(t *testing.T) {
+	dir := path.Join(config.RECIPES_DIR, "gitea")
+	os.RemoveAll(dir)
+
+	go func() {
+		p, err := os.FindProcess(os.Getpid())
+		if err != nil {
+			t.Fatalf("unable to find current process: %s", err)
+		}
+
+		p.Signal(syscall.SIGINT)
+	}()
+
+	gitURL := fmt.Sprintf("%s/%s.git", config.REPOS_BASE_URL, "gitea")
+	if err := Clone(dir, gitURL); err == nil {
+		t.Fatal("cloning should have been interrupted")
+	}
+
+	if _, err := os.Stat(dir); err != nil && !os.IsNotExist(err) {
+		t.Fatal("recipe repo was not deleted")
+	}
+}

pkg/lang/lang.go

@@ -0,0 +1,30 @@
+package lang
+
+import (
+	"os"
+	"strings"
+)
+
+func GetLocale() string {
+	if loc := os.Getenv("LC_MESSAGES"); loc != "" {
+		return NormalizeLocale(loc)
+	}
+
+	if loc := os.Getenv("LANG"); loc != "" {
+		return NormalizeLocale(loc)
+	}
+
+	return "C.UTF-8"
+}
+
+func NormalizeLocale(loc string) string {
+	if idx := strings.Index(loc, "."); idx != -1 {
+		return loc[:idx]
+	}
+
+	if idx := strings.Index(loc, "@"); idx != -1 {
+		return loc[:idx]
+	}
+
+	return loc
+}

pkg/lint/recipe.go

@@ -15,8 +15,10 @@ import (
 	"github.com/go-git/go-git/v5/plumbing"
 )
 
-var Warn = "warn"
-var Critical = "critical"
+var (
+	Warn     = "warn"
+	Critical = "critical"
+)
 
 type LintFunction func(recipe.Recipe) (bool, error)
 
@@ -182,6 +184,8 @@ var LintRules = map[string][]LintRule{
 func LintForErrors(recipe recipe.Recipe) error {
 	log.Debugf("linting for critical errors in %s configs", recipe.Name)
 
+	var errors string
+
 	for level := range LintRules {
 		if level != "error" {
 			continue
@@ -194,14 +198,18 @@ func LintForErrors(recipe recipe.Recipe) error {
 
 			ok, err := rule.Function(recipe)
 			if err != nil {
-				return err
+				errors += fmt.Sprintf("\nlint %s: %s", rule.Ref, err)
 			}
 			if !ok {
-				return fmt.Errorf("lint error in %s configs: \"%s\" failed lint checks (%s)", recipe.Name, rule.Description, rule.Ref)
+				errors += fmt.Sprintf("\n * %s (%s)", rule.Description, rule.Ref)
 			}
 		}
 	}
 
+	if len(errors) > 0 {
+		return fmt.Errorf("recipe '%s' failed lint checks:\n"+errors[1:], recipe.Name)
+	}
+
 	log.Debugf("linting successful, %s is well configured", recipe.Name)
 
 	return nil

pkg/log/log.go

@@ -2,8 +2,10 @@
 package log
 
 import (
+	"math"
 	"os"
 
+	tea "github.com/charmbracelet/bubbletea"
 	charmLog "github.com/charmbracelet/log"
 )
 
@@ -32,3 +34,13 @@ var SetLevel = Logger.SetLevel
 var DebugLevel = charmLog.DebugLevel
 var SetOutput = charmLog.SetOutput
 var SetReportCaller = charmLog.SetReportCaller
+
+type f func() (tea.Model, error)
+
+func Without(fn f) (tea.Model, error) {
+	l := Logger.GetLevel()
+	Logger.SetLevel(math.MaxInt)
+	m, err := fn()
+	Logger.SetLevel(l)
+	return m, err
+}

pkg/logs/logs.go

@@ -0,0 +1,104 @@
+package logs
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"os/signal"
+	"sync"
+
+	"github.com/docker/docker/api/types"
+	containerTypes "github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/filters"
+	dockerClient "github.com/docker/docker/client"
+)
+
+type TailOpts struct {
+	AppName  string
+	Services []string
+	StdErr   bool
+	Since    string
+	Buffer   *[]string
+	ToBuffer bool
+	Filters  filters.Args
+}
+
+// TailLogs gathers logs for the given app with optional service names to be
+// filtered on. These logs can be printed to os.Stdout or gathered to a buffer.
+func TailLogs(
+	cl *dockerClient.Client,
+	opts TailOpts,
+) error {
+	sigIntCh := make(chan os.Signal, 1)
+	signal.Notify(sigIntCh, os.Interrupt)
+	defer signal.Stop(sigIntCh)
+
+	services, err := cl.ServiceList(
+		context.Background(),
+		types.ServiceListOptions{Filters: opts.Filters},
+	)
+	if err != nil {
+		return err
+	}
+
+	errCh := make(chan error)
+	waitCh := make(chan struct{})
+
+	go func() {
+		var wg sync.WaitGroup
+		for _, service := range services {
+			wg.Add(1)
+			go func(serviceID string) {
+				tail := "50"
+				if opts.ToBuffer {
+					// NOTE(d1): more logs from before deployment when analysing via file
+					tail = "150"
+				}
+
+				logs, err := cl.ServiceLogs(context.Background(), serviceID, containerTypes.LogsOptions{
+					ShowStderr: true,
+					ShowStdout: !opts.StdErr,
+					Since:      opts.Since,
+					Until:      "",
+					Timestamps: true,
+					Follow:     true,
+					Tail:       tail,
+					Details:    false,
+				})
+
+				if err == nil {
+					defer logs.Close()
+					if opts.ToBuffer {
+						buf := bufio.NewScanner(logs)
+						for buf.Scan() {
+							line := fmt.Sprintf("%s: %s", service.Spec.Name, buf.Text())
+							*opts.Buffer = append(*opts.Buffer, line)
+						}
+						logs.Close()
+						return
+					}
+
+					if _, err = io.Copy(os.Stdout, logs); err != nil && err != io.EOF {
+						errCh <- fmt.Errorf("tailLogs: unable to copy buffer: %s", err)
+					}
+				}
+			}(service.ID)
+		}
+
+		wg.Wait()
+		close(waitCh)
+	}()
+
+	select {
+	case <-waitCh:
+		return nil
+	case <-sigIntCh:
+		return nil
+	case err := <-errCh:
+		return err
+	}
+
+	return nil
+}

pkg/recipe/git.go

@@ -40,14 +40,14 @@ func (r Recipe) Ensure(ctx EnsureContext) error {
 
 	if !ctx.Offline {
 		if err := r.EnsureUpToDate(); err != nil {
-			log.Fatal(err)
+			return err
 		}
 	}
 
 	if r.EnvVersion != "" && !ctx.IgnoreEnvVersion {
 		log.Debugf("ensuring env version %s", r.EnvVersion)
 		if strings.Contains(r.EnvVersion, "+U") {
-			log.Fatalf("can not redeploy chaos version (%s) without --chaos", r.EnvVersion)
+			return fmt.Errorf("can not redeploy chaos version (%s) without --chaos", r.EnvVersion)
 		}
 
 		if _, err := r.EnsureVersion(r.EnvVersion); err != nil {

pkg/secret/secret.go

@@ -33,6 +33,13 @@ type Secret struct {
 	// variable. For Example:
 	//   SECRET_FOO=v1 # length=12
 	Length int
+	// Charset comes from the charset modifier at the secret version environment
+	// variable. For Example:
+	//   SECRET_FOO=v1 # charset=default,special
+	Charset string
+	// Whether or not to skip generation of the secret or not
+	// For example: SECRET_FOO=v1 # generate=false
+	SkipGenerate bool
 	// RemoteName is the name of the secret on the server. For example:
 	//   name: ${STACK_NAME}_test_pass_two_${SECRET_TEST_PASS_TWO_VERSION}
 	// With the following:
@@ -43,38 +50,34 @@ type Secret struct {
 	RemoteName string
 }
 
-// GeneratePasswords generates passwords.
-func GeneratePasswords(count, length uint) ([]string, error) {
-	passwords, err := passgen.GeneratePasswords(
-		count,
-		length,
-		passgen.AlphabetDefault,
-	)
+// GeneratePassword generates passwords.
+func GeneratePassword(length uint, charset string) (string, error) {
+	passwords, err := passgen.GeneratePasswords(1, length, charset)
 	if err != nil {
-		return nil, err
+		return "", err
 	}
 
 	log.Debugf("generated %s", strings.Join(passwords, ", "))
 
-	return passwords, nil
+	return passwords[0], nil
 }
 
-// GeneratePassphrases generates human readable and rememberable passphrases.
-func GeneratePassphrases(count uint) ([]string, error) {
+// GeneratePassphrase generates human readable and rememberable passphrases.
+func GeneratePassphrase() (string, error) {
 	passphrases, err := passgen.GeneratePassphrases(
-		count,
+		1,
 		passgen.PassphraseWordCountDefault,
 		rune('-'),
 		passgen.PassphraseCasingDefault,
 		passgen.WordListDefault,
 	)
 	if err != nil {
-		return nil, err
+		return "", err
 	}
 
 	log.Debugf("generated %s", strings.Join(passphrases, ", "))
 
-	return passphrases, nil
+	return passphrases[0], nil
 }
 
 // ReadSecretsConfig reads secret names/versions from the recipe config. The
@@ -87,6 +90,7 @@ func ReadSecretsConfig(appEnvPath string, composeFiles []string, stackName strin
 	if err != nil {
 		return nil, err
 	}
+
 	// Set the STACK_NAME to be able to generate the remote name correctly.
 	appEnv["STACK_NAME"] = stackName
 
@@ -95,6 +99,7 @@ func ReadSecretsConfig(appEnvPath string, composeFiles []string, stackName strin
 	if err != nil {
 		return nil, err
 	}
+
 	// Read the compose files without injecting environment variables.
 	configWithoutEnv, err := loader.LoadComposefile(opts, map[string]string{}, loader.SkipInterpolation)
 	if err != nil {
@@ -142,6 +147,7 @@ func ReadSecretsConfig(appEnvPath string, composeFiles []string, stackName strin
 			if !strings.Contains(configWithoutEnv.Secrets[secretId].Name, envName) {
 				continue
 			}
+
 			lengthRaw, ok := modifierValues["length"]
 			if ok {
 				length, err := strconv.Atoi(lengthRaw)
@@ -150,6 +156,15 @@ func ReadSecretsConfig(appEnvPath string, composeFiles []string, stackName strin
 				}
 				value.Length = length
 			}
+
+			generateRaw, ok := modifierValues["generate"]
+			if ok {
+				if generateRaw == "false" {
+					value.SkipGenerate = true
+				}
+			}
+
+			value.Charset = resolveCharset(modifierValues["charset"])
 			break
 		}
 		secretValues[secretId] = value
@@ -158,6 +173,22 @@ func ReadSecretsConfig(appEnvPath string, composeFiles []string, stackName strin
 	return secretValues, nil
 }
 
+// resolveCharset sets the passgen Alphabet required for a secret
+func resolveCharset(input string) string {
+	switch strings.ToLower(input) {
+	case "special":
+		return passgen.AlphabetSpecial
+	case "safespecial":
+		return "!@#%^&*_-+="
+	case "default,special", "special,default":
+		return passgen.AlphabetDefault + passgen.AlphabetSpecial
+	case "default,safespecial", "safespecial,default":
+		return passgen.AlphabetDefault + "!@#%^&*_-+="
+	default:
+		return passgen.AlphabetDefault // Fallback to default
+	}
+}
+
 // GenerateSecrets generates secrets locally and sends them to a remote server for storage.
 func GenerateSecrets(cl *dockerClient.Client, secrets map[string]Secret, server string) (map[string]string, error) {
 	secretsGenerated := map[string]string{}
@@ -170,16 +201,22 @@ func GenerateSecrets(cl *dockerClient.Client, secrets map[string]Secret, server
 		go func(secretName string, secret Secret) {
 			defer wg.Done()
 
+			if secret.SkipGenerate {
+				log.Debugf("skipping generation of %s (generate=false)", secretName)
+				ch <- nil
+				return
+			}
+
 			log.Debugf("attempting to generate and store %s on %s", secret.RemoteName, server)
 
 			if secret.Length > 0 {
-				passwords, err := GeneratePasswords(1, uint(secret.Length))
+				password, err := GeneratePassword(uint(secret.Length), secret.Charset)
 				if err != nil {
 					ch <- err
 					return
 				}
 
-				if err := client.StoreSecret(cl, secret.RemoteName, passwords[0], server); err != nil {
+				if err := client.StoreSecret(cl, secret.RemoteName, password); err != nil {
 					if strings.Contains(err.Error(), "AlreadyExists") {
 						log.Warnf("%s already exists", secret.RemoteName)
 						ch <- nil
@@ -191,15 +228,15 @@ func GenerateSecrets(cl *dockerClient.Client, secrets map[string]Secret, server
 
 				mutex.Lock()
 				defer mutex.Unlock()
-				secretsGenerated[secretName] = passwords[0]
+				secretsGenerated[secretName] = password
 			} else {
-				passphrases, err := GeneratePassphrases(1)
+				passphrase, err := GeneratePassphrase()
 				if err != nil {
 					ch <- err
 					return
 				}
 
-				if err := client.StoreSecret(cl, secret.RemoteName, passphrases[0], server); err != nil {
+				if err := client.StoreSecret(cl, secret.RemoteName, passphrase); err != nil {
 					if strings.Contains(err.Error(), "AlreadyExists") {
 						log.Warnf("%s already exists", secret.RemoteName)
 						ch <- nil
@@ -211,7 +248,7 @@ func GenerateSecrets(cl *dockerClient.Client, secrets map[string]Secret, server
 
 				mutex.Lock()
 				defer mutex.Unlock()
-				secretsGenerated[secretName] = passphrases[0]
+				secretsGenerated[secretName] = passphrase
 			}
 			ch <- nil
 		}(n, v)

pkg/secret/secret_test.go

@@ -17,16 +17,37 @@ func TestReadSecretsConfig(t *testing.T) {
 	assert.Equal(t, "test_example_com_test_pass_one_v2", secretsFromConfig["test_pass_one"].RemoteName)
 	assert.Equal(t, "v2", secretsFromConfig["test_pass_one"].Version)
 	assert.Equal(t, 0, secretsFromConfig["test_pass_one"].Length)
+	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789", secretsFromConfig["test_pass_one"].Charset)
 
 	// Has a length modifier
 	assert.Equal(t, "test_example_com_test_pass_two_v1", secretsFromConfig["test_pass_two"].RemoteName)
 	assert.Equal(t, "v1", secretsFromConfig["test_pass_two"].Version)
 	assert.Equal(t, 10, secretsFromConfig["test_pass_two"].Length)
+	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789", secretsFromConfig["test_pass_two"].Charset)
 
 	// Secret name does not include the secret id
 	assert.Equal(t, "test_example_com_pass_three_v2", secretsFromConfig["test_pass_three"].RemoteName)
 	assert.Equal(t, "v2", secretsFromConfig["test_pass_three"].Version)
 	assert.Equal(t, 0, secretsFromConfig["test_pass_three"].Length)
+	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789", secretsFromConfig["test_pass_three"].Charset)
+
+	// Has a length modifier and a charset=default,safespecial modifier
+	assert.Equal(t, "test_example_com_test_pass_four_v1", secretsFromConfig["test_pass_four"].RemoteName)
+	assert.Equal(t, "v1", secretsFromConfig["test_pass_four"].Version)
+	assert.Equal(t, 12, secretsFromConfig["test_pass_four"].Length)
+	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789!@#%^&*_-+=", secretsFromConfig["test_pass_four"].Charset)
+
+	// Has a length modifier and a charset=default,special modifier
+	assert.Equal(t, "test_example_com_test_pass_five_v1", secretsFromConfig["test_pass_five"].RemoteName)
+	assert.Equal(t, "v1", secretsFromConfig["test_pass_five"].Version)
+	assert.Equal(t, 12, secretsFromConfig["test_pass_five"].Length)
+	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789!@#$%^&*_-+=", secretsFromConfig["test_pass_five"].Charset)
+
+	// Has only a charset=default,special modifier, which gets setted but ignored in the generation
+	assert.Equal(t, "test_example_com_test_pass_six_v1", secretsFromConfig["test_pass_six"].RemoteName)
+	assert.Equal(t, "v1", secretsFromConfig["test_pass_six"].Version)
+	assert.Equal(t, 0, secretsFromConfig["test_pass_six"].Length)
+	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789!@#$%^&*_-+=", secretsFromConfig["test_pass_six"].Charset)
 }
 
 func TestReadSecretsConfigWithLongDomain(t *testing.T) {

pkg/secret/testdir/.env.sample

@@ -1,3 +1,6 @@
 SECRET_TEST_PASS_ONE_VERSION=v2
 SECRET_TEST_PASS_TWO_VERSION=v1 # length=10
 SECRET_TEST_PASS_THREE_VERSION=v2
+SECRET_TEST_PASS_FOUR_VERSION=v1 # length=12 charset=default,safespecial
+SECRET_TEST_PASS_FIVE_VERSION=v1 # length=12 charset=default,special
+SECRET_TEST_PASS_SIX_VERSION=v1 # charset=default,special

pkg/secret/testdir/compose.yaml

@@ -8,6 +8,9 @@ services:
       - test_pass_one
       - test_pass_two
       - test_pass_three
+      - test_pass_four
+      - test_pass_five
+      - test_pass_six
 
 secrets:
   test_pass_one:
@@ -19,3 +22,12 @@ secrets:
   test_pass_three:
     external: true
     name: ${STACK_NAME}_pass_three_${SECRET_TEST_PASS_THREE_VERSION} # secretId and name don't match
+  test_pass_four:
+    external: true
+    name: ${STACK_NAME}_test_pass_four_${SECRET_TEST_PASS_FOUR_VERSION}
+  test_pass_five:
+    external: true
+    name: ${STACK_NAME}_test_pass_five_${SECRET_TEST_PASS_FIVE_VERSION}
+  test_pass_six:
+    external: true
+    name: ${STACK_NAME}_test_pass_six_${SECRET_TEST_PASS_SIX_VERSION}

pkg/server/server.go

@@ -12,7 +12,7 @@ import (
 func CreateServerDir(serverName string) error {
 	serverPath := path.Join(config.ABRA_DIR, "servers", serverName)
 
-	if err := os.Mkdir(serverPath, 0764); err != nil {
+	if err := os.Mkdir(serverPath, 0700); err != nil {
 		if !os.IsExist(err) {
 			return err
 		}

pkg/ssh/ssh.go

@@ -20,6 +20,8 @@ func Fatal(hostname string, err error) error {
 		return fmt.Errorf("ssh auth: permission denied for %s", hostname)
 	} else if strings.Contains(out, "Network is unreachable") {
 		return fmt.Errorf("unable to connect to %s, please check your SSH config", hostname)
+	} else if strings.Contains(out, "Is the docker daemon running") {
+		return fmt.Errorf("docker: is the daemon running / your user has docker permissions?")
 	}
 
 	return err

pkg/ui/deploy.go

@@ -0,0 +1,353 @@
+package ui
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"sort"
+	"strings"
+	"time"
+
+	"coopcloud.tech/abra/pkg/formatter"
+	"coopcloud.tech/abra/pkg/logs"
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/docker/cli/cli/command/service/progress"
+	containerTypes "github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/filters"
+	dockerClient "github.com/docker/docker/client"
+	"github.com/docker/docker/pkg/jsonmessage"
+)
+
+var IsRunning bool
+
+type statusMsg struct {
+	stream  stream
+	jsonMsg jsonmessage.JSONMessage
+}
+
+type progressCompleteMsg struct {
+	stream stream
+	failed bool
+}
+
+type healthcheckMsg struct {
+	stream stream
+	health string
+}
+
+type ServiceMeta struct {
+	Name string
+	ID   string
+}
+
+type Model struct {
+	appName string
+	cl      *dockerClient.Client
+	count   int
+	ctx     context.Context
+	timeout time.Duration
+	width   int
+	filters filters.Args
+
+	Streams  *[]stream
+	Logs     *[]string
+	Failed   bool
+	TimedOut bool
+	Quit     bool
+}
+
+func (m Model) complete() bool {
+	if m.count == len(*m.Streams) {
+		return true
+	}
+	return false
+}
+
+type stream struct {
+	Name string
+	Err  error
+
+	decoder  *json.Decoder
+	id       string
+	reader   *io.PipeReader
+	writer   *io.PipeWriter
+	status   string
+	retries  int
+	health   string
+	rollback bool
+}
+
+func (s stream) String() string {
+	out := fmt.Sprintf("{decoder: %v, ", s.decoder)
+	out += fmt.Sprintf("err: %v, ", s.Err)
+	out += fmt.Sprintf("id: %s, ", s.id)
+	out += fmt.Sprintf("name: %s, ", s.Name)
+	out += fmt.Sprintf("reader: %v, ", s.reader)
+	out += fmt.Sprintf("writer: %v, ", s.writer)
+	out += fmt.Sprintf("status: %s, ", s.status)
+	return out
+}
+
+func (s stream) progress(m Model) tea.Msg {
+	if err := progress.ServiceProgress(m.ctx, m.cl, s.id, s.writer); err != nil {
+		return progressCompleteMsg{
+			stream: s,
+			failed: true,
+		}
+	}
+
+	return progressCompleteMsg{stream: s}
+}
+
+func (s stream) process() tea.Msg {
+	var jsonMsg jsonmessage.JSONMessage
+
+	if err := s.decoder.Decode(&jsonMsg); err != nil {
+		if err == io.EOF {
+			// NOTE(d1): end processing messages
+			return nil
+		}
+	}
+
+	return statusMsg{
+		stream:  s,
+		jsonMsg: jsonMsg,
+	}
+}
+
+func (s stream) healthcheck(m Model) tea.Msg {
+	filters := filters.NewArgs()
+	filters.Add("name", fmt.Sprintf("^%s", s.Name))
+
+	containers, err := m.cl.ContainerList(m.ctx, containerTypes.ListOptions{Filters: filters})
+	if err != nil {
+		s.Err = err
+		return healthcheckMsg{stream: s}
+	}
+
+	if len(containers) == 0 {
+		return healthcheckMsg{stream: s}
+	}
+
+	container := containers[0]
+	containerState, err := m.cl.ContainerInspect(m.ctx, container.ID)
+	if err != nil {
+		s.Err = err
+		return healthcheckMsg{stream: s}
+	}
+
+	var health string
+	if containerState.State.Health != nil {
+		health = containerState.State.Health.Status
+	}
+
+	return healthcheckMsg{stream: s, health: health}
+}
+
+func DeployInitialModel(
+	ctx context.Context,
+	cl *dockerClient.Client,
+	services []ServiceMeta,
+	appName string,
+	timeout time.Duration,
+	filters filters.Args,
+) Model {
+	var streams []stream
+	for _, service := range services {
+		r, w := io.Pipe()
+		d := json.NewDecoder(r)
+		streams = append(streams, stream{
+			Name:    service.Name,
+			id:      service.ID,
+			reader:  r,
+			writer:  w,
+			decoder: d,
+			retries: -1, // NOTE(d1): skip first attempt
+			health:  "?",
+		})
+	}
+
+	sort.Slice(streams, func(i, j int) bool {
+		return streams[i].Name < streams[j].Name
+	})
+
+	return Model{
+		ctx:     ctx,
+		cl:      cl,
+		appName: appName,
+		timeout: timeout,
+		filters: filters,
+		Streams: &streams,
+		Logs:    &[]string{},
+	}
+}
+
+func (m Model) Init() tea.Cmd {
+	var cmds []tea.Cmd
+
+	for _, stream := range *m.Streams {
+		cmds = append(
+			cmds,
+			[]tea.Cmd{
+				func() tea.Msg { return stream.progress(m) },
+				func() tea.Msg { return stream.process() },
+				func() tea.Msg { return stream.healthcheck(m) },
+			}...,
+		)
+	}
+
+	cmds = append(cmds, func() tea.Msg { return deployTimeout(m) })
+	cmds = append(cmds, func() tea.Msg { return m.gatherLogs() })
+
+	return tea.Batch(cmds...)
+}
+
+func (m Model) gatherLogs() tea.Msg {
+	var services []string
+	for _, s := range *m.Streams {
+		services = append(services, s.Name)
+	}
+
+	opts := logs.TailOpts{
+		AppName:  m.appName,
+		Services: services,
+		StdErr:   true,
+		Buffer:   m.Logs,
+		ToBuffer: true,
+		Filters:  m.filters,
+	}
+
+	// NOTE(d1): not interested in log polling errors. if we don't see logs it
+	// will hopefully be self-evident based on what happened in the deployment
+	logs.TailLogs(m.cl, opts)
+
+	return nil
+}
+
+type timeoutMsg struct{}
+
+func deployTimeout(m Model) tea.Msg {
+	<-time.After(m.timeout)
+	return timeoutMsg{}
+}
+
+func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
+	var cmds []tea.Cmd
+
+	switch msg := msg.(type) {
+	case tea.KeyMsg:
+		switch msg.String() {
+		case "ctrl+c", "q":
+			m.Quit = true
+			return m, tea.Quit
+		}
+
+	case tea.WindowSizeMsg:
+		m.width = msg.Width
+
+	case progressCompleteMsg:
+		if msg.failed {
+			m.Failed = true
+		}
+
+		m.count += 1
+
+		if m.complete() {
+			return m, tea.Quit
+		}
+
+	case timeoutMsg:
+		m.TimedOut = true
+		return m, tea.Quit
+
+	case healthcheckMsg:
+		for idx, s := range *m.Streams {
+			if s.id == msg.stream.id {
+				h := "?"
+				if s.health != "" {
+					h = s.health
+				}
+				if msg.health != "" {
+					h = msg.health
+				}
+				(*m.Streams)[idx].health = h
+			}
+		}
+
+		cmds = append(
+			cmds,
+			func() tea.Msg { return msg.stream.healthcheck(m) },
+		)
+
+	case statusMsg:
+		for idx, s := range *m.Streams {
+			if s.id == msg.stream.id {
+
+				if msg.jsonMsg.ID == "rollback" {
+					m.Failed = true
+					(*m.Streams)[idx].rollback = true
+				}
+
+				if msg.jsonMsg.ID != "overall progress" {
+					newStatus := strings.ToLower(msg.jsonMsg.Status)
+					currentStatus := (*m.Streams)[idx].status
+
+					if !strings.Contains(currentStatus, "starting") &&
+						strings.Contains(newStatus, "starting") {
+						(*m.Streams)[idx].retries += 1
+					}
+
+					if (*m.Streams)[idx].rollback {
+						if msg.jsonMsg.ID == "rollback" {
+							(*m.Streams)[idx].status = newStatus
+						}
+					} else {
+						(*m.Streams)[idx].status = newStatus
+					}
+				}
+			}
+		}
+
+		cmds = append(
+			cmds,
+			func() tea.Msg { return msg.stream.process() },
+		)
+	}
+
+	return m, tea.Batch(cmds...)
+}
+
+func (m Model) View() string {
+	body := strings.Builder{}
+
+	for _, stream := range *m.Streams {
+		split := strings.Split(stream.Name, "_")
+		short := split[len(split)-1]
+
+		status := stream.status
+		if strings.Contains(stream.status, "converged") && !stream.rollback {
+			status = "succeeded"
+		}
+		if strings.Contains(stream.status, "rolled back") {
+			status = "rolled back"
+		}
+
+		retries := 0
+		if stream.retries > 0 {
+			retries = stream.retries
+		}
+
+		output := fmt.Sprintf("%s: %s (retries: %v, healthcheck: %s)",
+			formatter.BoldStyle.Render(short),
+			status,
+			retries,
+			stream.health,
+		)
+
+		body.WriteString(output)
+		body.WriteString("\n")
+	}
+
+	return body.String()
+}

pkg/upstream/stack/remove.go

@@ -3,8 +3,11 @@ package stack // https://github.com/docker/cli/blob/master/cli/command/stack/rem
 import (
 	"context"
 	"fmt"
+	"os"
+	"os/signal"
 	"sort"
 	"strings"
+	"time"
 
 	"coopcloud.tech/abra/pkg/log"
 	"github.com/docker/docker/api/types"
@@ -18,57 +21,87 @@ import (
 
 // RunRemove is the swarm implementation of docker stack remove
 func RunRemove(ctx context.Context, client *apiclient.Client, opts Remove) error {
-	var errs []string
-	for _, namespace := range opts.Namespaces {
-		services, err := GetStackServices(ctx, client, namespace)
-		if err != nil {
-			return err
-		}
+	sigIntCh := make(chan os.Signal, 1)
+	signal.Notify(sigIntCh, os.Interrupt)
+	defer signal.Stop(sigIntCh)
 
-		networks, err := getStackNetworks(ctx, client, namespace)
-		if err != nil {
-			return err
-		}
+	waitCh := make(chan struct{})
+	errCh := make(chan error)
 
-		var secrets []swarm.Secret
-		if versions.GreaterThanOrEqualTo(client.ClientVersion(), "1.25") {
-			secrets, err = getStackSecrets(ctx, client, namespace)
+	go func() {
+		var errs []string
+		for _, namespace := range opts.Namespaces {
+			services, err := GetStackServices(ctx, client, namespace)
 			if err != nil {
-				return err
+				errCh <- err
+				return
+			}
+
+			networks, err := getStackNetworks(ctx, client, namespace)
+			if err != nil {
+				errCh <- err
+				return
+			}
+
+			var secrets []swarm.Secret
+			if versions.GreaterThanOrEqualTo(client.ClientVersion(), "1.25") {
+				secrets, err = getStackSecrets(ctx, client, namespace)
+				if err != nil {
+					errCh <- err
+					return
+				}
+			}
+
+			var configs []swarm.Config
+			if versions.GreaterThanOrEqualTo(client.ClientVersion(), "1.30") {
+				configs, err = getStackConfigs(ctx, client, namespace)
+				if err != nil {
+					errCh <- err
+					return
+				}
+			}
+
+			if len(services)+len(networks)+len(secrets)+len(configs) == 0 {
+				log.Warnf("nothing found in stack: %s", namespace)
+				continue
+			}
+
+			hasError := removeServices(ctx, client, services)
+			hasError = removeSecrets(ctx, client, secrets) || hasError
+			hasError = removeConfigs(ctx, client, configs) || hasError
+			hasError = removeNetworks(ctx, client, networks) || hasError
+
+			if hasError {
+				errs = append(errs, fmt.Sprintf("failed to remove some resources from stack: %s", namespace))
+				continue
+			}
+
+			log.Debug("polling undeploy status")
+			timeout, err := waitOnTasks(ctx, client, namespace)
+			if timeout {
+				errs = append(errs, err.Error())
+			} else {
+				if err != nil {
+					errs = append(errs, fmt.Sprintf("failed to wait on tasks of stack: %s: %s", namespace, err))
+				}
 			}
 		}
 
-		var configs []swarm.Config
-		if versions.GreaterThanOrEqualTo(client.ClientVersion(), "1.30") {
-			configs, err = getStackConfigs(ctx, client, namespace)
-			if err != nil {
-				return err
-			}
+		if len(errs) > 0 {
+			errCh <- errors.New(strings.Join(errs, "\n"))
+			return
 		}
 
-		if len(services)+len(networks)+len(secrets)+len(configs) == 0 {
-			log.Warnf("nothing found in stack: %s", namespace)
-			continue
-		}
+		close(waitCh)
+	}()
 
-		hasError := removeServices(ctx, client, services)
-		hasError = removeSecrets(ctx, client, secrets) || hasError
-		hasError = removeConfigs(ctx, client, configs) || hasError
-		hasError = removeNetworks(ctx, client, networks) || hasError
-
-		if hasError {
-			errs = append(errs, fmt.Sprintf("failed to remove some resources from stack: %s", namespace))
-			continue
-		}
-
-		err = waitOnTasks(ctx, client, namespace)
-		if err != nil {
-			errs = append(errs, fmt.Sprintf("failed to wait on tasks of stack: %s: %s", namespace, err))
-		}
-	}
-
-	if len(errs) > 0 {
-		return errors.Errorf(strings.Join(errs, "\n"))
+	select {
+	case <-waitCh:
+		return nil
+	case <-sigIntCh:
+		return fmt.Errorf("skipping as requested, undeploy still in progress 🟠")
+	case err := <-errCh:
+		return err
 	}
 
 	return nil
@@ -88,7 +121,7 @@ func removeServices(
 	var hasError bool
 	sort.Slice(services, sortServiceByName(services))
 	for _, service := range services {
-		log.Infof("removing service %s", service.Spec.Name)
+		log.Debugf("removing service %s", service.Spec.Name)
 		if err := client.ServiceRemove(ctx, service.ID); err != nil {
 			hasError = true
 			log.Fatalf("failed to remove service %s: %s", service.ID, err)
@@ -104,7 +137,7 @@ func removeNetworks(
 ) bool {
 	var hasError bool
 	for _, network := range networks {
-		log.Infof("removing network %s", network.Name)
+		log.Debugf("removing network %s", network.Name)
 		if err := client.NetworkRemove(ctx, network.ID); err != nil {
 			hasError = true
 			log.Fatalf("failed to remove network %s: %s", network.ID, err)
@@ -120,7 +153,7 @@ func removeSecrets(
 ) bool {
 	var hasError bool
 	for _, secret := range secrets {
-		log.Infof("removing secret %s", secret.Spec.Name)
+		log.Debugf("removing secret %s", secret.Spec.Name)
 		if err := client.SecretRemove(ctx, secret.ID); err != nil {
 			hasError = true
 			log.Fatalf("Failed to remove secret %s: %s", secret.ID, err)
@@ -136,7 +169,7 @@ func removeConfigs(
 ) bool {
 	var hasError bool
 	for _, config := range configs {
-		log.Infof("removing config %s", config.Spec.Name)
+		log.Debugf("removing config %s", config.Spec.Name)
 		if err := client.ConfigRemove(ctx, config.ID); err != nil {
 			hasError = true
 			log.Fatalf("failed to remove config %s: %s", config.ID, err)
@@ -170,12 +203,23 @@ func terminalState(state swarm.TaskState) bool {
 	return numberedStates[state] > numberedStates[swarm.TaskStateRunning]
 }
 
-func waitOnTasks(ctx context.Context, client apiclient.APIClient, namespace string) error {
+func waitOnTasks(ctx context.Context, client apiclient.APIClient, namespace string) (bool, error) {
+	var timedOut bool
+
+	log.Debugf("waiting on undeploy tasks (timeout=%v secs)", WaitTimeout)
+
+	go func() {
+		t := time.Duration(WaitTimeout) * time.Second
+		<-time.After(t)
+		log.Debug("timed out on undeploy")
+		timedOut = true
+	}()
+
 	terminalStatesReached := 0
 	for {
 		tasks, err := getStackTasks(ctx, client, namespace)
 		if err != nil {
-			return fmt.Errorf("failed to get tasks: %w", err)
+			return false, fmt.Errorf("failed to get tasks: %w", err)
 		}
 
 		for _, task := range tasks {
@@ -188,6 +232,11 @@ func waitOnTasks(ctx context.Context, client apiclient.APIClient, namespace stri
 		if terminalStatesReached == len(tasks) {
 			break
 		}
+
+		if timedOut {
+			return true, fmt.Errorf("deployment timed out 🟠")
+		}
 	}
-	return nil
+
+	return false, nil
 }

pkg/upstream/stack/stack.go

@@ -3,20 +3,21 @@ package stack // https://github.com/docker/cli/blob/master/cli/command/stack/swa
 import (
 	"context"
 	"fmt"
-	"io"
-	"io/ioutil"
 	"os"
-	"os/signal"
+	"path/filepath"
 	"strconv"
 	"strings"
 	"time"
 
 	stdlibErr "errors"
 
+	tea "github.com/charmbracelet/bubbletea"
+
 	"coopcloud.tech/abra/pkg/config"
 	"coopcloud.tech/abra/pkg/log"
+	"coopcloud.tech/abra/pkg/ui"
 	"coopcloud.tech/abra/pkg/upstream/convert"
-	"github.com/docker/cli/cli/command/service/progress"
+	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/cli/command/stack/formatter"
 	composetypes "github.com/docker/cli/cli/compose/types"
 	"github.com/docker/docker/api/types"
@@ -177,7 +178,7 @@ func IsDeployed(ctx context.Context, cl *dockerClient.Client, stackName string)
 func pruneServices(ctx context.Context, cl *dockerClient.Client, namespace convert.Namespace, services map[string]struct{}) {
 	oldServices, err := GetStackServices(ctx, cl, namespace.Name())
 	if err != nil {
-		log.Infof("failed to list services: %s", err)
+		log.Warnf("failed to list services: %s", err)
 	}
 
 	pruneServices := []swarm.Service{}
@@ -191,7 +192,17 @@ func pruneServices(ctx context.Context, cl *dockerClient.Client, namespace conve
 }
 
 // RunDeploy is the swarm implementation of docker stack deploy
-func RunDeploy(cl *dockerClient.Client, opts Deploy, cfg *composetypes.Config, appName string, dontWait bool) error {
+func RunDeploy(
+	cl *dockerClient.Client,
+	opts Deploy,
+	cfg *composetypes.Config,
+	appName string,
+	serverName string,
+	dontWait bool,
+	filters filters.Args,
+) error {
+	log.Info("initialising deployment")
+
 	if err := validateResolveImageFlag(&opts); err != nil {
 		return err
 	}
@@ -201,7 +212,16 @@ func RunDeploy(cl *dockerClient.Client, opts Deploy, cfg *composetypes.Config, a
 		opts.ResolveImage = ResolveImageNever
 	}
 
-	return deployCompose(context.Background(), cl, opts, cfg, appName, dontWait)
+	return deployCompose(
+		context.Background(),
+		cl,
+		opts,
+		cfg,
+		appName,
+		serverName,
+		dontWait,
+		filters,
+	)
 }
 
 // validateResolveImageFlag validates the opts.resolveImage command line option
@@ -214,7 +234,16 @@ func validateResolveImageFlag(opts *Deploy) error {
 	}
 }
 
-func deployCompose(ctx context.Context, cl *dockerClient.Client, opts Deploy, config *composetypes.Config, appName string, dontWait bool) error {
+func deployCompose(
+	ctx context.Context,
+	cl *dockerClient.Client,
+	opts Deploy,
+	config *composetypes.Config,
+	appName string,
+	serverName string,
+	dontWait bool,
+	filters filters.Args,
+) error {
 	namespace := convert.NewNamespace(opts.Namespace)
 
 	if opts.Prune {
@@ -255,7 +284,14 @@ func deployCompose(ctx context.Context, cl *dockerClient.Client, opts Deploy, co
 		return err
 	}
 
-	serviceIDs, err := deployServices(ctx, cl, services, namespace, opts.SendRegistryAuth, opts.ResolveImage)
+	serviceIDs, err := deployServices(
+		ctx,
+		cl,
+		services,
+		namespace,
+		opts.SendRegistryAuth,
+		opts.ResolveImage,
+	)
 	if err != nil {
 		return err
 	}
@@ -265,13 +301,16 @@ func deployCompose(ctx context.Context, cl *dockerClient.Client, opts Deploy, co
 		return nil
 	}
 
-	log.Infof("waiting for %s to deploy... please hold 🤚", appName)
-
-	if err := waitOnServices(ctx, cl, serviceIDs, appName); err != nil {
-		return err
+	waitOpts := WaitOpts{
+		Services:   serviceIDs,
+		AppName:    appName,
+		ServerName: serverName,
+		Filters:    filters,
 	}
 
-	log.Infof("successfully deployed %s", appName)
+	if err := WaitOnServices(ctx, cl, waitOpts); err != nil {
+		return err
+	}
 
 	return nil
 }
@@ -343,7 +382,7 @@ func createConfigs(ctx context.Context, cl *dockerClient.Client, configs []swarm
 			}
 		case dockerClient.IsErrNotFound(err):
 			// config does not exist, then we create a new one.
-			log.Infof("creating config %s", configSpec.Name)
+			log.Debugf("creating config %s", configSpec.Name)
 			if _, err := cl.ConfigCreate(ctx, configSpec); err != nil {
 				return errors.Wrapf(err, "failed to create config %s", configSpec.Name)
 			}
@@ -374,7 +413,7 @@ func createNetworks(ctx context.Context, cl *dockerClient.Client, namespace conv
 			createOpts.Driver = defaultNetworkDriver
 		}
 
-		log.Infof("creating network %s", name)
+		log.Debugf("creating network %s", name)
 		if _, err := cl.NetworkCreate(ctx, name, createOpts); err != nil {
 			return errors.Wrapf(err, "failed to create network %s", name)
 		}
@@ -388,10 +427,13 @@ func deployServices(
 	services map[string]swarm.ServiceSpec,
 	namespace convert.Namespace,
 	sendAuth bool,
-	resolveImage string) ([]string, error) {
+	resolveImage string,
+) ([]ui.ServiceMeta, error) {
+	var servicesMeta []ui.ServiceMeta
+
 	existingServices, err := GetStackServices(ctx, cl, namespace.Name())
 	if err != nil {
-		return nil, err
+		return servicesMeta, err
 	}
 
 	existingServiceMap := make(map[string]swarm.Service)
@@ -399,8 +441,6 @@ func deployServices(
 		existingServiceMap[service.Spec.Name] = service
 	}
 
-	var serviceIDs []string
-
 	for internalName, serviceSpec := range services {
 		var (
 			name        = namespace.Scope(internalName)
@@ -408,8 +448,23 @@ func deployServices(
 			encodedAuth string
 		)
 
+		// When sendAuth is set, use the docker cli to retrieve the auth token
+		// for the image we are deploying.
+		// This enables using a private registry by running docker login on the
+		// machine, that abra is executed.
+		if sendAuth {
+			dockerCLI, err := command.NewDockerCli()
+			if err != nil {
+				log.Errorf("retrieving docker auth token: failed create docker cli: %s", err)
+			}
+			encodedAuth, err = command.RetrieveAuthTokenFromImage(dockerCLI.ConfigFile(), image)
+			if err != nil {
+				log.Errorf("failed to retrieve registry auth for image %s: %s", image, err)
+			}
+		}
+
 		if service, exists := existingServiceMap[name]; exists {
-			log.Infof("updating %s", name)
+			log.Debugf("updating %s", name)
 
 			updateOpts := types.ServiceUpdateOptions{EncodedRegistryAuth: encodedAuth}
 
@@ -451,9 +506,12 @@ func deployServices(
 				log.Warn(warning)
 			}
 
-			serviceIDs = append(serviceIDs, service.ID)
+			servicesMeta = append(servicesMeta, ui.ServiceMeta{
+				Name: name,
+				ID:   service.ID,
+			})
 		} else {
-			log.Infof("creating %s", name)
+			log.Debugf("creating %s", name)
 
 			createOpts := types.ServiceCreateOptions{EncodedRegistryAuth: encodedAuth}
 
@@ -467,11 +525,14 @@ func deployServices(
 				return nil, errors.Wrapf(err, "failed to create %s", name)
 			}
 
-			serviceIDs = append(serviceIDs, serviceCreateResponse.ID)
+			servicesMeta = append(servicesMeta, ui.ServiceMeta{
+				Name: name,
+				ID:   serviceCreateResponse.ID,
+			})
 		}
 	}
 
-	return serviceIDs, nil
+	return servicesMeta, nil
 }
 
 func getStackNetworks(ctx context.Context, dockerclient client.APIClient, namespace string) ([]networktypes.Inspect, error) {
@@ -486,67 +547,89 @@ func getStackConfigs(ctx context.Context, dockerclient client.APIClient, namespa
 	return dockerclient.ConfigList(ctx, types.ConfigListOptions{Filters: getStackFilter(namespace)})
 }
 
-func waitOnServices(ctx context.Context, cl *dockerClient.Client, serviceIDs []string, appName string) error {
-	var errs []error
+func timestamp() string {
+	ts := time.Now().UTC().Format(time.RFC3339)
+	return strings.Replace(ts, ":", "", -1) // get rid of offensive colons
+}
 
-	for _, serviceID := range serviceIDs {
-		if err := WaitOnService(ctx, cl, serviceID, appName); err != nil {
-			errs = append(errs, fmt.Errorf("%s: %w", serviceID, err))
-		}
+type WaitOpts struct {
+	AppName    string
+	Filters    filters.Args
+	NoLog      bool
+	Quiet      bool
+	ServerName string
+	Services   []ui.ServiceMeta
+}
+
+func WaitOnServices(ctx context.Context, cl *dockerClient.Client, opts WaitOpts) error {
+	timeout := time.Duration(WaitTimeout) * time.Second
+	model := ui.DeployInitialModel(ctx, cl, opts.Services, opts.AppName, timeout, opts.Filters)
+	tui := tea.NewProgram(model)
+
+	if !opts.Quiet {
+		log.Info("polling deployment status")
 	}
 
-	if len(errs) > 0 {
+	m, err := log.Without(
+		func() (tea.Model, error) {
+			return tui.Run()
+		},
+	)
+	if err != nil {
+		return fmt.Errorf("waitOnServices: error running TUI: %s", err)
+	}
+
+	deployModel := m.(ui.Model)
+	if deployModel.TimedOut || deployModel.Failed || deployModel.Quit {
+		var errs []error
+
+		if deployModel.Failed {
+			errs = append(errs, fmt.Errorf("deploy failed 🛑"))
+		} else if deployModel.TimedOut {
+			errs = append(errs, fmt.Errorf("deploy timed out 🟠"))
+		} else {
+			errs = append(errs, fmt.Errorf("deploy in progress 🟠"))
+		}
+
+		for _, s := range *deployModel.Streams {
+			if s.Err != nil {
+				errs = append(errs, fmt.Errorf("%s: %s", s.Name, s.Err))
+			}
+		}
+
+		if len(*deployModel.Logs) > 0 && !opts.NoLog {
+			logsPath := filepath.Join(
+				config.LOGS_DIR,
+				opts.ServerName,
+				fmt.Sprintf("%s_%s", opts.AppName, timestamp()),
+			)
+
+			if err := os.MkdirAll(filepath.Join(config.LOGS_DIR, opts.ServerName), 0o764); err != nil {
+				return fmt.Errorf("waitOnServices: error creating log dir: %s", err)
+			}
+
+			file, err := os.Create(logsPath)
+			if err != nil {
+				return fmt.Errorf("waitOnServices: error opening file: %s", err)
+			}
+			defer file.Close()
+
+			s := strings.Join(*deployModel.Logs, "\n")
+			if _, err := file.WriteString(s); err != nil {
+				return fmt.Errorf("waitOnServices: writeFile: %s", err)
+			}
+
+			errs = append(errs, fmt.Errorf("logs: %s", logsPath))
+		}
+
 		return stdlibErr.Join(errs...)
 	}
 
-	return nil
-}
-
-// https://github.com/docker/cli/blob/master/cli/command/service/helpers.go
-// https://github.com/docker/cli/blob/master/cli/command/service/progress/progress.go
-func WaitOnService(ctx context.Context, cl *dockerClient.Client, serviceID, appName string) error {
-	errChan := make(chan error, 1)
-	pipeReader, pipeWriter := io.Pipe()
-
-	sigintChannel := make(chan os.Signal, 1)
-	signal.Notify(sigintChannel, os.Interrupt)
-	defer signal.Stop(sigintChannel)
-
-	go func() {
-		errChan <- progress.ServiceProgress(ctx, cl, serviceID, pipeWriter)
-	}()
-
-	go io.Copy(ioutil.Discard, pipeReader)
-
-	timeout := time.Duration(WaitTimeout) * time.Second
-
-	select {
-	case err := <-errChan:
-		return err
-	case <-sigintChannel:
-		return fmt.Errorf(`
-Not waiting for %s to deploy. The deployment is ongoing...
-
-If you want to stop the deployment, try:
-
-    abra app undeploy %s`, appName, appName)
-	case <-time.After(timeout):
-		return fmt.Errorf(`
-%s has not converged (%s second timeout reached).
-
-This does not necessarily mean your deployment has failed, it may just be that
-the app is taking longer to deploy based on your server resources or network
-latency.
-
-You can track latest deployment status with:
-
-    abra app ps %s
-
-And inspect the logs with:
-
-    abra app logs %s
-`, appName, timeout, appName, appName)
+	if !opts.Quiet {
+		log.Info("deploy succeeded 🟢")
 	}
+
+	return nil
 }
 
 // Copypasta from https://github.com/docker/cli/blob/master/cli/command/stack/swarm/list.go

scripts/installer/installer

@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
 
-ABRA_VERSION="0.9.0-beta"
+ABRA_VERSION="0.10.1-beta"
 ABRA_RELEASE_URL="https://git.coopcloud.tech/api/v1/repos/toolshed/abra/releases/tags/$ABRA_VERSION"
-RC_VERSION="0.10.0-rc1-beta"
+RC_VERSION="0.10.1-beta"
 RC_VERSION_URL="https://git.coopcloud.tech/api/v1/repos/toolshed/abra/releases/tags/$RC_VERSION"
 
 for arg in "$@"; do

scripts/installer/makefile

@@ -3,5 +3,5 @@ STACK := abra_installer_script
 default: deploy
 
 deploy:
-	@DOCKER_CONTEXT=swarm.autonomic.zone docker stack rm $(STACK) && \
-		DOCKER_CONTEXT=swarm.autonomic.zone docker stack deploy -c compose.yml $(STACK)
+	@DOCKER_CONTEXT=swarm-0.coopcloud.tech docker stack rm $(STACK) && \
+		DOCKER_CONTEXT=swarm-0.coopcloud.tech docker stack deploy -c compose.yml $(STACK)

tests/integration/app_deploy.bats

@@ -75,6 +75,45 @@ teardown(){
   assert_success
 }
 
+# bats test_tags=slow
+@test "bail if recipe lint errors and no --chaos" {
+  # Break the recipe
+  run sed -i '/traefik.enable=.*/d' "$ABRA_DIR/recipes/$TEST_RECIPE/compose.yml"
+  assert_success
+
+  # Commit the breakage (so we can test without --chaos)
+  _set_git_author
+
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" commit -a -m 'Break recipe'
+  assert_success
+
+  # Make a broken release
+  run $ABRA recipe sync --patch "$TEST_RECIPE"
+  run $ABRA recipe release --patch -n "$TEST_RECIPE"
+
+  # Make sure we deploy latest
+  _wipe_env_version
+  
+  run $ABRA app deploy "$TEST_APP_DOMAIN" --no-input
+  assert_failure
+  assert_output --partial 'failed lint checks'
+
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" reset --hard HEAD~1
+  latestRelease=$(_latest_release)
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" tag -d "$latestRelease"
+}
+
+# bats test_tags=slow
+@test "warn on recipe lint errors with --chaos" {
+  # Break the recipe
+  run sed -i '/traefik.enable=.*/d' "$ABRA_DIR/recipes/$TEST_RECIPE/compose.yml"
+  assert_success
+
+  run $ABRA app deploy "$TEST_APP_DOMAIN" --no-input --no-converge-checks --chaos
+  assert_success
+  assert_output --partial 'failed lint checks'
+}
+
 # bats test_tags=slow
 @test "ensure recipe up to date if no --offline" {
   wantHash=$(_get_n_hash 3)
@@ -108,8 +147,6 @@ teardown(){
 
 # bats test_tags=slow
 @test "deploy latest commit if no published versions and no --chaos" {
-  latestCommit="$(git -C "$ABRA_DIR/recipes/$TEST_RECIPE" rev-parse --short HEAD)"
-
   _remove_tags
   _wipe_env_version
 
@@ -117,7 +154,7 @@ teardown(){
   run $ABRA app deploy "$TEST_APP_DOMAIN" \
     --no-input --no-converge-checks --offline
   assert_success
-  assert_output --partial "$latestCommit"
+  assert_output --partial "${_get_head_hash:0:8}"
 }
 
 # bats test_tags=slow
@@ -149,16 +186,6 @@ teardown(){
   assert_exists "$ABRA_DIR/recipes/$TEST_RECIPE"
 }
 
-@test "no deploy if lint error" {
-  run sed -i '/traefik.enable=.*/d' "$ABRA_DIR/recipes/$TEST_RECIPE/compose.yml"
-  assert_success
-
-  run $ABRA app deploy "$TEST_APP_DOMAIN" \
-    --no-input --no-converge-checks --chaos
-  assert_failure
-  assert_output --partial 'failed lint checks'
-}
-
 # bats test_tags=slow
 @test "error if already deployed and no --force/--chaos" {
   _deploy_app
@@ -403,8 +430,6 @@ teardown(){
 
 # bats test_tags=slow
 @test "ignore env version on new deploy" {
-  tagHash=$(_get_tag_hash "0.1.0+1.20.0")
-
   run $ABRA app deploy "$TEST_APP_DOMAIN" "0.1.0+1.20.0" \
     --no-input --no-converge-checks
   assert_success

tests/integration/app_list.bats

@@ -8,8 +8,19 @@ setup_file(){
 }
 
 teardown_file(){
+  if [[ ! -f "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env" ]]; then
+    _new_app
+  fi
+
+  _undeploy_app
   _rm_app
   _rm_server
+
+  if [[ -d "$ABRA_DIR/servers/foo" ]]; then
+    run rm -rf "$ABRA_DIR/servers/foo"
+    assert_success
+    assert_not_exists "$ABRA_DIR/servers/foo"
+  fi
 }
 
 setup(){
@@ -18,7 +29,19 @@ setup(){
 }
 
 teardown(){
+  if [[ ! -f "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env" ]]; then
+    _new_app
+  fi
+
   _undeploy_app
+  _wipe_env_version
+  _reset_recipe
+
+  if [[ -d "$ABRA_DIR/servers/foo" ]]; then
+    run rm -rf "$ABRA_DIR/servers/foo"
+    assert_success
+    assert_not_exists "$ABRA_DIR/servers/foo"
+  fi
 }
 
 @test "list without status" {
@@ -87,6 +110,10 @@ teardown(){
   assert_success
   refute_output --partial "$TEST_RECIPE"
   assert_output --partial "foo-recipe"
+
+  run rm -rf "$ABRA_DIR/servers/foo.com"
+  assert_success
+  assert_not_exists "$ABRA_DIR/servers/foo.com"
 }
 
 @test "output is machine readable" {
@@ -98,3 +125,71 @@ teardown(){
 
   assert_output --partial "$expectedOutput"
 }
+
+# bats test_tags=slow
+@test "list with status fetches recipe" {
+  _deploy_app
+
+  run $ABRA app ls --status
+  assert_success
+
+  run rm -rf "$ABRA_DIR/recipes/$TEST_RECIPE"
+  assert_success
+
+  run $ABRA app ls --status
+  assert_success
+}
+
+# bats test_tags=slow
+@test "list with chaos version" {
+  run bash -c "echo foo >> $ABRA_DIR/recipes/$TEST_RECIPE/foo"
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
+
+  run $ABRA app deploy "$TEST_APP_DOMAIN" \
+    --no-input --no-converge-checks --chaos
+  assert_success
+
+  run $ABRA app ls --status
+  assert_success
+  assert_output --partial "+U"
+
+  run rm -rf "$ABRA_DIR/servers/foo.com"
+  assert_success
+  assert_not_exists "$ABRA_DIR/servers/foo.com"
+}
+
+@test "list with status skips unknown servers" {
+  if [[ ! -d "$ABRA_DIR/servers/foo" ]]; then
+    run mkdir -p "$ABRA_DIR/servers/foo"
+    assert_success
+    assert_exists "$ABRA_DIR/servers/foo"
+
+    run cp "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env" \
+           "$ABRA_DIR/servers/foo/$TEST_APP_DOMAIN.env"
+    assert_success
+    assert_exists "$ABRA_DIR/servers/foo/$TEST_APP_DOMAIN.env"
+  fi
+
+  run $ABRA app ls --status
+  assert_success
+  assert_output --partial "unknown server"
+}
+
+# bats test_tags=slow
+@test "list does not fail if missing .env" {
+  _deploy_app
+
+  run $ABRA app ls --status
+  assert_success
+
+  run rm -rf "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+  assert_not_exists "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+
+  output=$("$ABRA" app ls --server "$TEST_SERVER" --status --machine)
+  run diff \
+    <(jq -S "." <(echo "$output")) \
+    <(jq -S "." <(echo '{}'))
+  assert_success
+}

tests/integration/app_new.bats

@@ -214,8 +214,7 @@ teardown(){
     --chaos
   assert_success
   assert_exists "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
-  assert_output --partial "version: ${currentHash:0:8}"
-  assert_output --partial "chaos: ${currentHash:0:8}"
+  assert_output --partial "version: ${currentHash:0:8}+U"
 
   assert_exists "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
   assert_equal "$(_git_status)" "?? foo"
@@ -242,8 +241,7 @@ teardown(){
     --chaos
   assert_success
   assert_exists "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
-  assert_output --partial "version: ${currentHash:0:8}"
-  assert_output --partial "chaos: ${currentHash:0:8}"
+  assert_output --partial "version: ${currentHash:0:8}+U"
 
   assert_exists "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
   assert_equal "$(_git_status)" "?? foo"
@@ -252,3 +250,10 @@ teardown(){
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
   assert_success
 }
+
+@test "automatically select single server" {
+  # NOTE(d1): no --no-input required, single server available
+  run $ABRA app new "$TEST_RECIPE" --domain "$TEST_APP_DOMAIN"
+  assert_success
+  assert_exists "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+}

tests/integration/app_remove.bats

@@ -124,6 +124,33 @@ teardown(){
   assert_output --partial 'removed'
 }
 
+# bats test_tags=slow
+@test "detect no configs to remove" {
+  _deploy_app
+  _undeploy_app
+
+  run $ABRA app rm "$TEST_APP_DOMAIN" --no-input
+  assert_success
+  assert_output --partial 'no configs to remove'
+}
+
+# bats test_tags=slow
+@test "remove old app configs" {
+  _deploy_app
+  _undeploy_app
+
+  sanitisedDomainName="${TEST_APP_DOMAIN//./_}"
+  run docker config create "${sanitisedDomainName}_test_conf_v99" "$ABRA_DIR/recipes/abra-test-recipe/abra.sh"
+  assert_success
+
+  assert bash -c "docker config ls | grep -q test_conf_v99"
+
+  run $ABRA app rm "$TEST_APP_DOMAIN" --no-input
+  assert_success
+
+  refute bash -c "docker config ls | grep -q test_conf_v99"
+}
+
 @test "remove .env file" {
   assert_exists "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
 

tests/integration/app_secret.bats

@@ -4,6 +4,7 @@ setup_file(){
   load "$PWD/tests/integration/helpers/common"
   _common_setup
   _add_server
+  _fetch_recipe
 
   # NOTE(d1): create new app without secrets
   run $ABRA app new "$TEST_RECIPE" \
@@ -181,6 +182,20 @@ teardown(){
   assert_output --partial '10'  # NOTE(d1): hardcoded # length=10 in recipe config
 }
 
+@test "generate: skip if generate=false" {
+  run sed -i 's/COMPOSE_FILE="compose.yml"/COMPOSE_FILE="compose.yml:compose.skip_pass.yml"/g' \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  run sed -i 's/#SECRET_TEST_SKIP_PASS_VERSION=v1/SECRET_TEST_SKIP_PASS_VERSION=v1/g' \
+    "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+  assert_success
+
+  run $ABRA app secret generate "$TEST_APP_DOMAIN" --all
+  assert_success
+  refute_output --partial 'test_skip_pass'
+}
+
 @test "insert: validate arguments" {
   run $ABRA app secret insert
   assert_failure
@@ -195,6 +210,12 @@ teardown(){
   assert_failure
 }
 
+@test "insert: cannot insert unknown secret" {
+  run $ABRA app secret insert "$TEST_APP_DOMAIN" DOESNTEXIST v1 foo
+  assert_failure
+  assert_output --partial 'no secret'
+}
+
 @test "insert: create secret" {
   run $ABRA app secret ls "$TEST_APP_DOMAIN"
   assert_success

tests/integration/app_undeploy.bats

@@ -30,6 +30,20 @@ teardown(){
   assert_failure
 }
 
+# bats test_tags=slow
+@test "retrieve recipe if missing" {
+  _deploy_app
+
+  run rm -rf "$ABRA_DIR/recipes/$TEST_RECIPE"
+  assert_success
+  assert_not_exists "$ABRA_DIR/recipes/$TEST_RECIPE"
+
+  run $ABRA app undeploy "$TEST_APP_DOMAIN" --no-input
+  assert_success
+
+  assert_exists "$ABRA_DIR/recipes/$TEST_RECIPE"
+}
+
 # bats test_tags=slow
 @test "ensure recipe up to date if no --offline" {
   _deploy_app

tests/integration/app_upgrade.bats

@@ -204,6 +204,18 @@ teardown(){
   assert_output --partial 'release notes baz' # 0.2.0+1.21.0
 }
 
+# bats test_tags=slow
+@test "show release note added after release" {
+  run $ABRA app deploy "$TEST_APP_DOMAIN" "0.2.0+1.21.0" --no-input --no-converge-checks
+  assert_success
+  assert_output --partial '0.2.0+1.21.0'
+
+  run $ABRA app upgrade "$TEST_APP_DOMAIN" "0.3.0+1.21.0" --no-input --no-converge-checks
+  assert_success
+  assert_output --partial '0.3.0+1.21.0'
+  assert_output --partial 'A release note added after the release'
+}
+
 # bats test_tags=slow
 @test "upgrade commit deployment not possible" {
   tagHash=$(_get_tag_hash "0.1.0+1.20.0")

tests/integration/app_upgrade_overview.bats

@@ -76,7 +76,7 @@ teardown(){
   assert_output --partial 'UPGRADE OVERVIEW'
   assert_output --partial 'CURRENT DEPLOYMENT    0.2.0+1.21.0'
   assert_output --partial 'ENV VERSION           N/A'
-  assert_output --partial 'NEW DEPLOYMENT        0.3.1+1.21.0'
+  assert_output --partial "NEW DEPLOYMENT        $latestRelease"
 
   run grep -q "TYPE=$TEST_RECIPE:${latestRelease}" \
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"

tests/integration/app_volume.bats

@@ -63,20 +63,24 @@ teardown(){
 
 # bats test_tags=slow
 @test "remove volumes" {
-  sleep 3 # NOTE(d1): hack to avoid "network not found"
-
   _deploy_app
   _undeploy_app
 
+  run $ABRA app volume ls "$TEST_APP_DOMAIN"
+  assert_success
+  assert_output --partial 'test-volume'
+
   run $ABRA app volume rm "$TEST_APP_DOMAIN" --force
   assert_success
   assert_output --partial 'volumes removed successfully'
+
+  run $ABRA app volume ls "$TEST_APP_DOMAIN"
+  assert_success
+  assert_output --partial 'no volumes created'
 }
 
 # bats test_tags=slow
 @test "remove no volumes" {
-  sleep 3 # NOTE(d1): hack to avoid "network not found"
-
   _deploy_app
   _undeploy_app
 
@@ -88,3 +92,59 @@ teardown(){
   assert_success
   assert_output --partial 'no volumes removed'
 }
+
+# bats test_tags=slow
+@test "remove single volume" {
+  _deploy_app
+  _undeploy_app
+
+  run $ABRA app volume ls "$TEST_APP_DOMAIN"
+  assert_success
+  assert_output --partial 'test-volume'
+  assert_output --partial 'test-volume-two'
+
+  run $ABRA app volume rm "$TEST_APP_DOMAIN" test-volume-two --force
+  assert_success
+  assert_output --partial 'test-volume-two removed successfully'
+
+  run $ABRA app volume ls "$TEST_APP_DOMAIN"
+  assert_success
+  assert_output --partial 'test-volume'
+  refute_output --partial 'test-volume-two'
+
+  run $ABRA app volume rm "$TEST_APP_DOMAIN" --force
+  assert_success
+  assert_output --partial 'volumes removed successfully'
+
+  run $ABRA app volume ls "$TEST_APP_DOMAIN"
+  assert_success
+  assert_output --partial 'no volumes created'
+}
+
+# bats test_tags=slow
+@test "remove single volume incorrect name" {
+  _deploy_app
+  _undeploy_app
+
+  run $ABRA app volume rm "$TEST_APP_DOMAIN" DOESNTEXIST --force
+  assert_failure
+  assert_output --partial 'no volume with name'
+}
+
+# bats test_tags=slow
+@test "remove single volume doesn't delete similar name" {
+  _deploy_app
+  _undeploy_app
+
+  run $ABRA app volume ls "$TEST_APP_DOMAIN"
+  assert_success
+  assert_output --partial 'test-volume-two'
+
+  run $ABRA app volume rm "$TEST_APP_DOMAIN" test-volume --force
+  assert_success
+  assert_output --partial 'test-volume removed successfully'
+
+  run $ABRA app volume ls "$TEST_APP_DOMAIN"
+  assert_success
+  assert_output --partial 'test-volume-two'
+}

tests/integration/dirs.bats

@@ -24,7 +24,7 @@ setup(){
   assert_success
 }
 
-@test "abra directory is created" {
+@test "abra directories are created" {
   run $ABRA app ls
 
   # NOTE(d1): no servers yet, so will fail. however, it will run the required
@@ -35,8 +35,9 @@ setup(){
   assert_exists "$ABRA_DIR"
   assert_exists "$ABRA_DIR/servers"
   assert_exists "$ABRA_DIR/recipes"
-  assert_exists "$ABRA_DIR/backups"
-  assert_exists "$ABRA_DIR/vendor"
 
   assert_not_exists "$ABRA_DIR/catalogue"
+
+  server_dir_perms=$(stat -c "%a" "$ABRA_DIR/servers")
+  assert_equal $server_dir_perms "700"
 }

tests/integration/helpers/app.bash

@@ -1,6 +1,8 @@
 #!/usr/bin/env bash
 
 _new_app() {
+  _fetch_recipe
+
   run $ABRA app new "$TEST_RECIPE" \
     --no-input \
     --server "$TEST_SERVER" \

tests/integration/helpers/docker.bash

@@ -2,7 +2,7 @@
 
 _ensure_swarm() {
   if [ "$(docker info | grep Swarm | sed 's/Swarm: //g' | tr -d ' ')" == "inactive" ]; then
-    run docker swarm init
+    run docker swarm init --advertise-addr 127.0.0.1:2377
     assert_success
   fi
 

tests/integration/install.bats

@@ -25,13 +25,3 @@ teardown(){
   run "$HOME/.local/bin/abra" -v
   assert_output --partial 'beta'
 }
-
-# bats test_tags=slow
-@test "install release candidate from script" {
-  run bash -c 'curl https://install.abra.coopcloud.tech | bash -s -- --rc'
-  assert_success
-
-  assert_exists "$HOME/.local/bin/abra"
-  run "$HOME/.local/bin/abra" -v
-  assert_output --partial '-rc'
-}

tests/integration/recipe_diff.bats

@@ -3,6 +3,7 @@
 setup() {
   load "$PWD/tests/integration/helpers/common"
   _common_setup
+  _fetch_recipe
 }
 
 teardown(){

tests/integration/recipe_fetch.bats

@@ -5,6 +5,16 @@ setup() {
   _common_setup
 }
 
+teardown(){
+  run rm -rf "$ABRA_DIR/recipes/matrix-synapse"
+  assert_success
+  assert_not_exists "$ABRA_DIR/recipes/$TEST_RECIPE"
+
+  run rm -rf "$ABRA_DIR/recipes/git_coopcloud_tech_coop-cloud_matrix-synapse"
+  assert_success
+  assert_not_exists "$ABRA_DIR/recipes/git_coopcloud_tech_coop-cloud_matrix-synapse"
+}
+
 # bats test_tags=slow
 @test "recipe fetch all" {
   run rm -rf "$ABRA_DIR/recipes/matrix-synapse"
@@ -35,3 +45,81 @@ setup() {
   run $ABRA recipe fetch matrix-synapse --all
   assert_failure
 }
+
+@test "do not refetch without --force" {
+  run $ABRA recipe fetch matrix-synapse
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/matrix-synapse"
+
+  run $ABRA recipe fetch matrix-synapse
+  assert_output --partial "already fetched"
+}
+
+@test "refetch with --force" {
+  run $ABRA recipe fetch matrix-synapse
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/matrix-synapse"
+
+  run $ABRA recipe fetch matrix-synapse --force
+  assert_success
+  refute_output --partial "already fetched"
+}
+
+@test "refetch with --force does not erase unstaged changes" {
+  run $ABRA recipe fetch matrix-synapse
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/matrix-synapse"
+
+  run bash -c "echo foo >> $ABRA_DIR/recipes/matrix-synapse/foo"
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/matrix-synapse/foo"
+
+  run $ABRA recipe fetch matrix-synapse --force
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/matrix-synapse"
+  assert_exists "$ABRA_DIR/recipes/matrix-synapse/foo"
+}
+
+@test "fetch with --ssh" {
+  run $ABRA recipe fetch matrix-synapse --ssh
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/matrix-synapse"
+
+  run git -C "$ABRA_DIR/recipes/matrix-synapse" remote -v
+  assert_success
+  assert_output --partial "ssh://"
+}
+
+@test "re-fetch with --ssh/--force" {
+  run $ABRA recipe fetch matrix-synapse
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/matrix-synapse"
+
+  run git -C "$ABRA_DIR/recipes/matrix-synapse" remote -v
+  assert_success
+  assert_output --partial "https://"
+
+  run $ABRA recipe fetch matrix-synapse --ssh --force
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/matrix-synapse"
+
+  run git -C "$ABRA_DIR/recipes/matrix-synapse" remote -v
+  assert_success
+  assert_output --partial "ssh://"
+}
+
+@test "fetch remote recipe" {
+  run $ABRA recipe fetch git.coopcloud.tech/coop-cloud/matrix-synapse
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/git_coopcloud_tech_coop-cloud_matrix-synapse"
+}
+
+@test "remote recipe do not refetch without --force" {
+  run $ABRA recipe fetch git.coopcloud.tech/coop-cloud/matrix-synapse
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/git_coopcloud_tech_coop-cloud_matrix-synapse"
+
+  run $ABRA recipe fetch git.coopcloud.tech/coop-cloud/matrix-synapse
+  assert_success
+  assert_output --partial "already fetched"
+}

tests/integration/recipe_lint.bats

@@ -22,14 +22,16 @@ teardown(){
 }
 
 @test "retrieve recipe if missing" {
-  run rm -rf "$ABRA_DIR/recipes/$TEST_RECIPE"
-  assert_success
-  assert_not_exists "$ABRA_DIR/recipes/$TEST_RECIPE"
+  if [[ -d "$ABRA_DIR/recipe/custom-html" ]]; then
+    run rm -rf "$ABRA_DIR/recipes/custom-html"
+    assert_success
+    assert_not_exists "$ABRA_DIR/recipes/custom-html"
+  fi
 
-  run $ABRA recipe lint "$TEST_RECIPE"
+  run $ABRA recipe lint custom-html
   assert_success
 
-  assert_exists "$ABRA_DIR/recipes/$TEST_RECIPE"
+  assert_exists "$ABRA_DIR/recipes/custom-html"
 }
 
 @test "bail if unstaged changes and no --chaos" {

tests/integration/recipe_new.bats

@@ -68,3 +68,27 @@ teardown(){
   assert_output --partial 'fooUser'
   assert_output --partial 'foo@example.com'
 }
+
+# bats test_tags=slow
+@test "recipe new, app new, no releases, latest commit" {
+  recipeName="foobar"
+
+  run $ABRA recipe new "$recipeName"
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/$recipeName"
+
+  currentHash=$(git -C "$ABRA_DIR/recipes/$recipeName" show -s --format="%H")
+  domain="$recipeName.$TEST_APP_SERVER" 
+
+  run $ABRA app new "$recipeName" \
+    --no-input \
+    --server "$TEST_SERVER" \
+    --domain "$domain"
+  assert_success
+  assert_output --partial "version: ${currentHash:0:8}"
+  assert_exists "$ABRA_DIR/servers/$TEST_SERVER/$domain.env"
+
+  run grep -q "TYPE=$recipeName:${currentHash:0:8}" \
+    "$ABRA_DIR/servers/$TEST_SERVER/$domain.env"
+  assert_success
+}

tests/integration/recipe_upgrade.bats

@@ -30,15 +30,17 @@ teardown(){
 }
 
 @test "retrieve recipe if missing" {
-  run rm -rf "$ABRA_DIR/recipes/$TEST_RECIPE"
-  assert_success
-  assert_not_exists "$ABRA_DIR/recipes/$TEST_RECIPE"
+  if [[ -d "$ABRA_DIR/recipe/custom-html" ]]; then
+    run rm -rf "$ABRA_DIR/recipes/custom-html"
+    assert_success
+    assert_not_exists "$ABRA_DIR/recipes/custom-html"
+  fi
 
-  run $ABRA recipe upgrade "$TEST_RECIPE" --no-input
+  run $ABRA recipe upgrade "custom-html" --no-input
   assert_success
   assert_output --partial 'can upgrade service: app'
 
-  assert_exists "$ABRA_DIR/recipes/$TEST_RECIPE"
+  assert_exists "$ABRA_DIR/recipes/custom-html"
 }
 
 @test "error if unstaged changes" {

tests/integration/server_add.bats

@@ -25,6 +25,9 @@ teardown(){
   assert_output --partial "$TEST_SERVER"
 
   assert bash -c "docker context ls | grep -q $TEST_SERVER"
+
+  server_dir_perms=$(stat -c "%a" "$ABRA_DIR/servers/$TEST_SERVER")
+  assert_equal $server_dir_perms "700"
 }
 
 @test "error if using name and --local together" {
@@ -39,6 +42,9 @@ teardown(){
   assert_exists "$ABRA_DIR/servers/default"
   assert bash -c "docker context ls | grep -q default"
   assert_output --partial 'local server successfully added'
+
+  server_dir_perms=$(stat -c "%a" "$ABRA_DIR/servers/$TEST_SERVER")
+  assert_equal $server_dir_perms "700"
 }
 
 @test "create local server fails when no docker swarm" {

tests/integration/upgrade.bats

@@ -26,14 +26,3 @@ teardown(){
   run "$HOME/.local/bin/abra" -v
   assert_output --partial 'beta'
 }
-
-# bats test_tags=slow
-@test "abra upgrade release candidate" {
-  run $ABRA upgrade --rc
-  assert_success
-  assert_output --partial 'Public interest infrastructure'
-
-  assert_exists "$HOME/.local/bin/abra"
-  run "$HOME/.local/bin/abra" -v
-  assert_output --partial '-rc'
-}

vendor/coopcloud.tech/tagcmp/renovate.json

@@ -1,3 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json"
-}

vendor/coopcloud.tech/tagcmp/tagcmp.go

@@ -290,7 +290,7 @@ func patternMatches(tag string) error {
 
 	for _, pattern := range unsupported {
 		if match, _ := regexp.Match(pattern, []byte(tag)); match {
-			return fmt.Errorf("'%s' is not supported (%s)", tag, pattern)
+			return fmt.Errorf("version %s is not supported (matched: %s)", tag, pattern)
 		}
 	}
 

vendor/dario.cat/mergo/FUNDING.json

@@ -0,0 +1,7 @@
+{
+  "drips": {
+    "ethereum": {
+      "ownedBy": "0x6160020e7102237aC41bdb156e94401692D76930"
+    }
+  }
+}

vendor/dario.cat/mergo/README.md

@@ -85,7 +85,6 @@ Mergo is used by [thousands](https://deps.dev/go/dario.cat%2Fmergo/v1.0.0/depend
 * [goreleaser/goreleaser](https://github.com/goreleaser/goreleaser)
 * [go-micro/go-micro](https://github.com/go-micro/go-micro)
 * [grafana/loki](https://github.com/grafana/loki)
-* [kubernetes/kubernetes](https://github.com/kubernetes/kubernetes)
 * [masterminds/sprig](github.com/Masterminds/sprig)
 * [moby/moby](https://github.com/moby/moby)
 * [slackhq/nebula](https://github.com/slackhq/nebula)
@@ -191,10 +190,6 @@ func main() {
 }
 ```
 
-Note: if test are failing due missing package, please execute:
-
-    go get gopkg.in/yaml.v3
-
 ### Transformers
 
 Transformers allow to merge specific types differently than in the default behavior. In other words, now you can customize how some types are merged. For example, `time.Time` is a struct; it doesn't have zero value but IsZero can return true because it has fields with zero value. How can we merge a non-zero `time.Time`?

vendor/dario.cat/mergo/SECURITY.md

@@ -4,8 +4,8 @@
 
 | Version | Supported          |
 | ------- | ------------------ |
-| 0.3.x   | :white_check_mark: |
-| < 0.3   | :x:                |
+| 1.x.x   | :white_check_mark: |
+| < 1.0   | :x:                |
 
 ## Security contact information
 

vendor/github.com/BurntSushi/toml/README.md

@@ -3,7 +3,7 @@ reflection interface similar to Go's standard library `json` and `xml` packages.
 
 Compatible with TOML version [v1.0.0](https://toml.io/en/v1.0.0).
 
-Documentation: https://godocs.io/github.com/BurntSushi/toml
+Documentation: https://pkg.go.dev/github.com/BurntSushi/toml
 
 See the [releases page](https://github.com/BurntSushi/toml/releases) for a
 changelog; this information is also in the git tag annotations (e.g. `git show

vendor/github.com/BurntSushi/toml/decode.go

@@ -196,6 +196,19 @@ func (md *MetaData) PrimitiveDecode(primValue Primitive, v any) error {
 	return md.unify(primValue.undecoded, rvalue(v))
 }
 
+// markDecodedRecursive is a helper to mark any key under the given tmap as
+// decoded, recursing as needed
+func markDecodedRecursive(md *MetaData, tmap map[string]any) {
+	for key := range tmap {
+		md.decoded[md.context.add(key).String()] = struct{}{}
+		if tmap, ok := tmap[key].(map[string]any); ok {
+			md.context = append(md.context, key)
+			markDecodedRecursive(md, tmap)
+			md.context = md.context[0 : len(md.context)-1]
+		}
+	}
+}
+
 // unify performs a sort of type unification based on the structure of `rv`,
 // which is the client representation.
 //
@@ -222,6 +235,16 @@ func (md *MetaData) unify(data any, rv reflect.Value) error {
 		if err != nil {
 			return md.parseErr(err)
 		}
+		// Assume the Unmarshaler decoded everything, so mark all keys under
+		// this table as decoded.
+		if tmap, ok := data.(map[string]any); ok {
+			markDecodedRecursive(md, tmap)
+		}
+		if aot, ok := data.([]map[string]any); ok {
+			for _, tmap := range aot {
+				markDecodedRecursive(md, tmap)
+			}
+		}
 		return nil
 	}
 	if v, ok := rvi.(encoding.TextUnmarshaler); ok {
@@ -540,12 +563,14 @@ func (md *MetaData) badtype(dst string, data any) error {
 
 func (md *MetaData) parseErr(err error) error {
 	k := md.context.String()
+	d := string(md.data)
 	return ParseError{
-		LastKey:  k,
-		Position: md.keyInfo[k].pos,
-		Line:     md.keyInfo[k].pos.Line,
+		Message:  err.Error(),
 		err:      err,
-		input:    string(md.data),
+		LastKey:  k,
+		Position: md.keyInfo[k].pos.withCol(d),
+		Line:     md.keyInfo[k].pos.Line,
+		input:    d,
 	}
 }
 

vendor/github.com/BurntSushi/toml/encode.go

@@ -402,31 +402,30 @@ func (enc *Encoder) eMap(key Key, rv reflect.Value, inline bool) {
 
 	// Sort keys so that we have deterministic output. And write keys directly
 	// underneath this key first, before writing sub-structs or sub-maps.
-	var mapKeysDirect, mapKeysSub []string
+	var mapKeysDirect, mapKeysSub []reflect.Value
 	for _, mapKey := range rv.MapKeys() {
-		k := mapKey.String()
 		if typeIsTable(tomlTypeOfGo(eindirect(rv.MapIndex(mapKey)))) {
-			mapKeysSub = append(mapKeysSub, k)
+			mapKeysSub = append(mapKeysSub, mapKey)
 		} else {
-			mapKeysDirect = append(mapKeysDirect, k)
+			mapKeysDirect = append(mapKeysDirect, mapKey)
 		}
 	}
 
-	var writeMapKeys = func(mapKeys []string, trailC bool) {
-		sort.Strings(mapKeys)
+	writeMapKeys := func(mapKeys []reflect.Value, trailC bool) {
+		sort.Slice(mapKeys, func(i, j int) bool { return mapKeys[i].String() < mapKeys[j].String() })
 		for i, mapKey := range mapKeys {
-			val := eindirect(rv.MapIndex(reflect.ValueOf(mapKey)))
+			val := eindirect(rv.MapIndex(mapKey))
 			if isNil(val) {
 				continue
 			}
 
 			if inline {
-				enc.writeKeyValue(Key{mapKey}, val, true)
+				enc.writeKeyValue(Key{mapKey.String()}, val, true)
 				if trailC || i != len(mapKeys)-1 {
 					enc.wf(", ")
 				}
 			} else {
-				enc.encode(key.add(mapKey), val)
+				enc.encode(key.add(mapKey.String()), val)
 			}
 		}
 	}
@@ -441,8 +440,6 @@ func (enc *Encoder) eMap(key Key, rv reflect.Value, inline bool) {
 	}
 }
 
-const is32Bit = (32 << (^uint(0) >> 63)) == 32
-
 func pointerTo(t reflect.Type) reflect.Type {
 	if t.Kind() == reflect.Ptr {
 		return pointerTo(t.Elem())
@@ -477,15 +474,14 @@ func (enc *Encoder) eStruct(key Key, rv reflect.Value, inline bool) {
 
 			frv := eindirect(rv.Field(i))
 
-			if is32Bit {
-				// Copy so it works correct on 32bit archs; not clear why this
-				// is needed. See #314, and https://www.reddit.com/r/golang/comments/pnx8v4
-				// This also works fine on 64bit, but 32bit archs are somewhat
-				// rare and this is a wee bit faster.
-				copyStart := make([]int, len(start))
-				copy(copyStart, start)
-				start = copyStart
-			}
+			// Need to make a copy because ... ehm, I don't know why... I guess
+			// allocating a new array can cause it to fail(?)
+			//
+			// Done for: https://github.com/BurntSushi/toml/issues/430
+			// Previously only on 32bit for: https://github.com/BurntSushi/toml/issues/314
+			copyStart := make([]int, len(start))
+			copy(copyStart, start)
+			start = copyStart
 
 			// Treat anonymous struct fields with tag names as though they are
 			// not anonymous, like encoding/json does.
@@ -507,7 +503,7 @@ func (enc *Encoder) eStruct(key Key, rv reflect.Value, inline bool) {
 	}
 	addFields(rt, rv, nil)
 
-	writeFields := func(fields [][]int) {
+	writeFields := func(fields [][]int, totalFields int) {
 		for _, fieldIndex := range fields {
 			fieldType := rt.FieldByIndex(fieldIndex)
 			fieldVal := rv.FieldByIndex(fieldIndex)
@@ -537,7 +533,7 @@ func (enc *Encoder) eStruct(key Key, rv reflect.Value, inline bool) {
 
 			if inline {
 				enc.writeKeyValue(Key{keyName}, fieldVal, true)
-				if fieldIndex[0] != len(fields)-1 {
+				if fieldIndex[0] != totalFields-1 {
 					enc.wf(", ")
 				}
 			} else {
@@ -549,8 +545,10 @@ func (enc *Encoder) eStruct(key Key, rv reflect.Value, inline bool) {
 	if inline {
 		enc.wf("{")
 	}
-	writeFields(fieldsDirect)
-	writeFields(fieldsSub)
+
+	l := len(fieldsDirect) + len(fieldsSub)
+	writeFields(fieldsDirect, l)
+	writeFields(fieldsSub, l)
 	if inline {
 		enc.wf("}")
 	}

vendor/github.com/BurntSushi/toml/error.go

@@ -67,21 +67,36 @@ type ParseError struct {
 // Position of an error.
 type Position struct {
 	Line  int // Line number, starting at 1.
+	Col   int // Error column, starting at 1.
 	Start int // Start of error, as byte offset starting at 0.
-	Len   int // Lenght in bytes.
+	Len   int // Length of the error in bytes.
+}
+
+func (p Position) withCol(tomlFile string) Position {
+	var (
+		pos   int
+		lines = strings.Split(tomlFile, "\n")
+	)
+	for i := range lines {
+		ll := len(lines[i]) + 1 // +1 for the removed newline
+		if pos+ll >= p.Start {
+			p.Col = p.Start - pos + 1
+			if p.Col < 1 { // Should never happen, but just in case.
+				p.Col = 1
+			}
+			break
+		}
+		pos += ll
+	}
+	return p
 }
 
 func (pe ParseError) Error() string {
-	msg := pe.Message
-	if msg == "" { // Error from errorf()
-		msg = pe.err.Error()
-	}
-
 	if pe.LastKey == "" {
-		return fmt.Sprintf("toml: line %d: %s", pe.Position.Line, msg)
+		return fmt.Sprintf("toml: line %d: %s", pe.Position.Line, pe.Message)
 	}
 	return fmt.Sprintf("toml: line %d (last key %q): %s",
-		pe.Position.Line, pe.LastKey, msg)
+		pe.Position.Line, pe.LastKey, pe.Message)
 }
 
 // ErrorWithPosition returns the error with detailed location context.
@@ -92,26 +107,19 @@ func (pe ParseError) ErrorWithPosition() string {
 		return pe.Error()
 	}
 
-	var (
-		lines = strings.Split(pe.input, "\n")
-		col   = pe.column(lines)
-		b     = new(strings.Builder)
-	)
-
-	msg := pe.Message
-	if msg == "" {
-		msg = pe.err.Error()
-	}
-
 	// TODO: don't show control characters as literals? This may not show up
 	// well everywhere.
 
+	var (
+		lines = strings.Split(pe.input, "\n")
+		b     = new(strings.Builder)
+	)
 	if pe.Position.Len == 1 {
 		fmt.Fprintf(b, "toml: error: %s\n\nAt line %d, column %d:\n\n",
-			msg, pe.Position.Line, col+1)
+			pe.Message, pe.Position.Line, pe.Position.Col)
 	} else {
 		fmt.Fprintf(b, "toml: error: %s\n\nAt line %d, column %d-%d:\n\n",
-			msg, pe.Position.Line, col, col+pe.Position.Len)
+			pe.Message, pe.Position.Line, pe.Position.Col, pe.Position.Col+pe.Position.Len-1)
 	}
 	if pe.Position.Line > 2 {
 		fmt.Fprintf(b, "% 7d | %s\n", pe.Position.Line-2, expandTab(lines[pe.Position.Line-3]))
@@ -129,7 +137,7 @@ func (pe ParseError) ErrorWithPosition() string {
 	diff := len(expanded) - len(lines[pe.Position.Line-1])
 
 	fmt.Fprintf(b, "% 7d | %s\n", pe.Position.Line, expanded)
-	fmt.Fprintf(b, "% 10s%s%s\n", "", strings.Repeat(" ", col+diff), strings.Repeat("^", pe.Position.Len))
+	fmt.Fprintf(b, "% 10s%s%s\n", "", strings.Repeat(" ", pe.Position.Col-1+diff), strings.Repeat("^", pe.Position.Len))
 	return b.String()
 }
 
@@ -151,23 +159,6 @@ func (pe ParseError) ErrorWithUsage() string {
 	return m
 }
 
-func (pe ParseError) column(lines []string) int {
-	var pos, col int
-	for i := range lines {
-		ll := len(lines[i]) + 1 // +1 for the removed newline
-		if pos+ll >= pe.Position.Start {
-			col = pe.Position.Start - pos
-			if col < 0 { // Should never happen, but just in case.
-				col = 0
-			}
-			break
-		}
-		pos += ll
-	}
-
-	return col
-}
-
 func expandTab(s string) string {
 	var (
 		b    strings.Builder

vendor/github.com/BurntSushi/toml/lex.go

@@ -275,7 +275,9 @@ func (lx *lexer) errorPos(start, length int, err error) stateFn {
 func (lx *lexer) errorf(format string, values ...any) stateFn {
 	if lx.atEOF {
 		pos := lx.getPos()
-		pos.Line--
+		if lx.pos >= 1 && lx.input[lx.pos-1] == '\n' {
+			pos.Line--
+		}
 		pos.Len = 1
 		pos.Start = lx.pos - 1
 		lx.items <- item{typ: itemError, pos: pos, err: fmt.Errorf(format, values...)}
@@ -492,6 +494,9 @@ func lexKeyEnd(lx *lexer) stateFn {
 		lx.emit(itemKeyEnd)
 		return lexSkip(lx, lexValue)
 	default:
+		if r == '\n' {
+			return lx.errorPrevLine(fmt.Errorf("expected '.' or '=', but got %q instead", r))
+		}
 		return lx.errorf("expected '.' or '=', but got %q instead", r)
 	}
 }
@@ -560,6 +565,9 @@ func lexValue(lx *lexer) stateFn {
 	if r == eof {
 		return lx.errorf("unexpected EOF; expected value")
 	}
+	if r == '\n' {
+		return lx.errorPrevLine(fmt.Errorf("expected value but found %q instead", r))
+	}
 	return lx.errorf("expected value but found %q instead", r)
 }
 
@@ -1111,7 +1119,7 @@ func lexBaseNumberOrDate(lx *lexer) stateFn {
 	case 'x':
 		r = lx.peek()
 		if !isHex(r) {
-			lx.errorf("not a hexidecimal number: '%s%c'", lx.current(), r)
+			lx.errorf("not a hexadecimal number: '%s%c'", lx.current(), r)
 		}
 		return lexHexInteger
 	}
@@ -1259,23 +1267,6 @@ func isBinary(r rune) bool { return r == '0' || r == '1' }
 func isOctal(r rune) bool  { return r >= '0' && r <= '7' }
 func isHex(r rune) bool    { return (r >= '0' && r <= '9') || (r|0x20 >= 'a' && r|0x20 <= 'f') }
 func isBareKeyChar(r rune, tomlNext bool) bool {
-	if tomlNext {
-		return (r >= 'A' && r <= 'Z') ||
-			(r >= 'a' && r <= 'z') ||
-			(r >= '0' && r <= '9') ||
-			r == '_' || r == '-' ||
-			r == 0xb2 || r == 0xb3 || r == 0xb9 || (r >= 0xbc && r <= 0xbe) ||
-			(r >= 0xc0 && r <= 0xd6) || (r >= 0xd8 && r <= 0xf6) || (r >= 0xf8 && r <= 0x037d) ||
-			(r >= 0x037f && r <= 0x1fff) ||
-			(r >= 0x200c && r <= 0x200d) || (r >= 0x203f && r <= 0x2040) ||
-			(r >= 0x2070 && r <= 0x218f) || (r >= 0x2460 && r <= 0x24ff) ||
-			(r >= 0x2c00 && r <= 0x2fef) || (r >= 0x3001 && r <= 0xd7ff) ||
-			(r >= 0xf900 && r <= 0xfdcf) || (r >= 0xfdf0 && r <= 0xfffd) ||
-			(r >= 0x10000 && r <= 0xeffff)
-	}
-
-	return (r >= 'A' && r <= 'Z') ||
-		(r >= 'a' && r <= 'z') ||
-		(r >= '0' && r <= '9') ||
-		r == '_' || r == '-'
+	return (r >= 'A' && r <= 'Z') || (r >= 'a' && r <= 'z') ||
+		(r >= '0' && r <= '9') || r == '_' || r == '-'
 }

vendor/github.com/BurntSushi/toml/meta.go

@@ -135,9 +135,6 @@ func (k Key) maybeQuoted(i int) string {
 
 // Like append(), but only increase the cap by 1.
 func (k Key) add(piece string) Key {
-	if cap(k) > len(k) {
-		return append(k, piece)
-	}
 	newKey := make(Key, len(k)+1)
 	copy(newKey, k)
 	newKey[len(k)] = piece

vendor/github.com/BurntSushi/toml/parse.go

@@ -50,7 +50,6 @@ func parse(data string) (p *parser, err error) {
 	// it anyway.
 	if strings.HasPrefix(data, "\xff\xfe") || strings.HasPrefix(data, "\xfe\xff") { // UTF-16
 		data = data[2:]
-		//lint:ignore S1017 https://github.com/dominikh/go-tools/issues/1447
 	} else if strings.HasPrefix(data, "\xef\xbb\xbf") { // UTF-8
 		data = data[3:]
 	}
@@ -65,7 +64,7 @@ func parse(data string) (p *parser, err error) {
 	if i := strings.IndexRune(data[:ex], 0); i > -1 {
 		return nil, ParseError{
 			Message:  "files cannot contain NULL bytes; probably using UTF-16; TOML files must be UTF-8",
-			Position: Position{Line: 1, Start: i, Len: 1},
+			Position: Position{Line: 1, Col: 1, Start: i, Len: 1},
 			Line:     1,
 			input:    data,
 		}
@@ -92,8 +91,9 @@ func parse(data string) (p *parser, err error) {
 
 func (p *parser) panicErr(it item, err error) {
 	panic(ParseError{
+		Message:  err.Error(),
 		err:      err,
-		Position: it.pos,
+		Position: it.pos.withCol(p.lx.input),
 		Line:     it.pos.Len,
 		LastKey:  p.current(),
 	})
@@ -102,7 +102,7 @@ func (p *parser) panicErr(it item, err error) {
 func (p *parser) panicItemf(it item, format string, v ...any) {
 	panic(ParseError{
 		Message:  fmt.Sprintf(format, v...),
-		Position: it.pos,
+		Position: it.pos.withCol(p.lx.input),
 		Line:     it.pos.Len,
 		LastKey:  p.current(),
 	})
@@ -111,7 +111,7 @@ func (p *parser) panicItemf(it item, format string, v ...any) {
 func (p *parser) panicf(format string, v ...any) {
 	panic(ParseError{
 		Message:  fmt.Sprintf(format, v...),
-		Position: p.pos,
+		Position: p.pos.withCol(p.lx.input),
 		Line:     p.pos.Line,
 		LastKey:  p.current(),
 	})
@@ -123,10 +123,11 @@ func (p *parser) next() item {
 	if it.typ == itemError {
 		if it.err != nil {
 			panic(ParseError{
-				Position: it.pos,
+				Message:  it.err.Error(),
+				err:      it.err,
+				Position: it.pos.withCol(p.lx.input),
 				Line:     it.pos.Line,
 				LastKey:  p.current(),
-				err:      it.err,
 			})
 		}
 
@@ -527,7 +528,7 @@ func numUnderscoresOK(s string) bool {
 			}
 		}
 
-		// isHexis a superset of all the permissable characters surrounding an
+		// isHex is a superset of all the permissible characters surrounding an
 		// underscore.
 		accept = isHex(r)
 	}

vendor/github.com/ProtonMail/go-crypto/openpgp/errors/errors.go

@@ -180,6 +180,16 @@ func (dke ErrMalformedMessage) Error() string {
 	return "openpgp: malformed message " + string(dke)
 }
 
+type messageTooLargeError int
+
+func (e messageTooLargeError) Error() string {
+	return "openpgp: decompressed message size exceeds provided limit"
+}
+
+// ErrMessageTooLarge is returned if the read data from
+// a compressed packet exceeds the provided limit.
+var ErrMessageTooLarge error = messageTooLargeError(0)
+
 // ErrEncryptionKeySelection is returned if encryption key selection fails (v2 API).
 type ErrEncryptionKeySelection struct {
 	PrimaryKeyId      string

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_config.go

@@ -37,7 +37,7 @@ func (conf *AEADConfig) Mode() AEADMode {
 
 // ChunkSizeByte returns the byte indicating the chunk size. The effective
 // chunk size is computed with the formula uint64(1) << (chunkSizeByte + 6)
-// limit to 16 = 4 MiB
+// limit chunkSizeByte to 16 which equals to 2^22 = 4 MiB
 // https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-07.html#section-5.13.2
 func (conf *AEADConfig) ChunkSizeByte() byte {
 	if conf == nil || conf.ChunkSize == 0 {
@@ -49,8 +49,8 @@ func (conf *AEADConfig) ChunkSizeByte() byte {
 	switch {
 	case exponent < 6:
 		exponent = 6
-	case exponent > 16:
-		exponent = 16
+	case exponent > 22:
+		exponent = 22
 	}
 
 	return byte(exponent - 6)

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/compressed.go

@@ -98,6 +98,16 @@ func (c *Compressed) parse(r io.Reader) error {
 	return err
 }
 
+// LimitedBodyReader wraps the provided body reader with a limiter that restricts
+// the number of bytes read to the specified limit.
+// If limit is nil, the reader is unbounded.
+func (c *Compressed) LimitedBodyReader(limit *int64) io.Reader {
+	if limit == nil {
+		return c.Body
+	}
+	return &LimitReader{R: c.Body, N: *limit}
+}
+
 // compressedWriterCloser represents the serialized compression stream
 // header and the compressor. Its Close() method ensures that both the
 // compressor and serialized stream header are closed. Its Write()
@@ -159,3 +169,24 @@ func SerializeCompressed(w io.WriteCloser, algo CompressionAlgo, cc *Compression
 
 	return
 }
+
+// LimitReader is an io.Reader that fails with MessageToLarge if read bytes exceed N.
+type LimitReader struct {
+	R io.Reader // underlying reader
+	N int64     // max bytes allowed
+}
+
+func (l *LimitReader) Read(p []byte) (int, error) {
+	if l.N <= 0 {
+		return 0, errors.ErrMessageTooLarge
+	}
+
+	n, err := l.R.Read(p)
+	l.N -= int64(n)
+
+	if err == nil && l.N <= 0 {
+		err = errors.ErrMessageTooLarge
+	}
+
+	return n, err
+}

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/config.go

@@ -178,6 +178,11 @@ type Config struct {
 	// When set to true, a key without flags is treated as if all flags are enabled.
 	// This behavior is consistent with GPG.
 	InsecureAllowAllKeyFlagsWhenMissing bool
+
+	// MaxDecompressedMessageSize specifies the maximum number of bytes that can be
+	// read from a compressed packet. This serves as an upper limit to prevent
+	// excessively large decompressed messages.
+	MaxDecompressedMessageSize *int64
 }
 
 func (c *Config) Random() io.Reader {
@@ -415,6 +420,13 @@ func (c *Config) AllowAllKeyFlagsWhenMissing() bool {
 	return c.InsecureAllowAllKeyFlagsWhenMissing
 }
 
+func (c *Config) DecompressedMessageSizeLimit() *int64 {
+	if c == nil {
+		return nil
+	}
+	return c.MaxDecompressedMessageSize
+}
+
 // BoolPointer is a helper function to set a boolean pointer in the Config.
 // e.g., config.CheckPacketSequence = BoolPointer(true)
 func BoolPointer(value bool) *bool {

vendor/github.com/ProtonMail/go-crypto/openpgp/read.go

@@ -259,7 +259,7 @@ FindLiteralData:
 		}
 		switch p := p.(type) {
 		case *packet.Compressed:
-			if err := packets.Push(p.Body); err != nil {
+			if err := packets.Push(p.LimitedBodyReader(config.DecompressedMessageSizeLimit())); err != nil {
 				return nil, err
 			}
 		case *packet.OnePassSignature:

vendor/github.com/ProtonMail/go-crypto/openpgp/write.go

@@ -253,34 +253,12 @@ func writeAndSign(payload io.WriteCloser, candidateHashes []uint8, signed *Entit
 	}
 
 	var hash crypto.Hash
-	for _, hashId := range candidateHashes {
-		if h, ok := algorithm.HashIdToHash(hashId); ok && h.Available() {
-			hash = h
-			break
-		}
-	}
-
-	// If the hash specified by config is a candidate, we'll use that.
-	if configuredHash := config.Hash(); configuredHash.Available() {
-		for _, hashId := range candidateHashes {
-			if h, ok := algorithm.HashIdToHash(hashId); ok && h == configuredHash {
-				hash = h
-				break
-			}
-		}
-	}
-
-	if hash == 0 {
-		hashId := candidateHashes[0]
-		name, ok := algorithm.HashIdToString(hashId)
-		if !ok {
-			name = "#" + strconv.Itoa(int(hashId))
-		}
-		return nil, errors.InvalidArgumentError("cannot encrypt because no candidate hash functions are compiled in. (Wanted " + name + " in this case.)")
-	}
-
 	var salt []byte
 	if signer != nil {
+		if hash, err = selectHash(candidateHashes, config.Hash(), signer); err != nil {
+			return nil, err
+		}
+
 		var opsVersion = 3
 		if signer.Version == 6 {
 			opsVersion = signer.Version
@@ -558,13 +536,34 @@ func (s signatureWriter) Close() error {
 	return s.encryptedData.Close()
 }
 
+func selectHashForSigningKey(config *packet.Config, signer *packet.PublicKey) crypto.Hash {
+	acceptableHashes := acceptableHashesToWrite(signer)
+	hash, ok := algorithm.HashToHashId(config.Hash())
+	if !ok {
+		return config.Hash()
+	}
+	for _, acceptableHashes := range acceptableHashes {
+		if acceptableHashes == hash {
+			return config.Hash()
+		}
+	}
+	if len(acceptableHashes) > 0 {
+		defaultAcceptedHash, ok := algorithm.HashIdToHash(acceptableHashes[0])
+		if ok {
+			return defaultAcceptedHash
+		}
+	}
+	return config.Hash()
+}
+
 func createSignaturePacket(signer *packet.PublicKey, sigType packet.SignatureType, config *packet.Config) *packet.Signature {
 	sigLifetimeSecs := config.SigLifetime()
+	hash := selectHashForSigningKey(config, signer)
 	return &packet.Signature{
 		Version:           signer.Version,
 		SigType:           sigType,
 		PubKeyAlgo:        signer.PubKeyAlgo,
-		Hash:              config.Hash(),
+		Hash:              hash,
 		CreationTime:      config.Now(),
 		IssuerKeyId:       &signer.KeyId,
 		IssuerFingerprint: signer.Fingerprint,
@@ -618,3 +617,74 @@ func handleCompression(compressed io.WriteCloser, candidateCompression []uint8,
 	}
 	return data, nil
 }
+
+// selectHash selects the preferred hash given the candidateHashes and the configuredHash
+func selectHash(candidateHashes []byte, configuredHash crypto.Hash, signer *packet.PrivateKey) (hash crypto.Hash, err error) {
+	acceptableHashes := acceptableHashesToWrite(&signer.PublicKey)
+	candidateHashes = intersectPreferences(acceptableHashes, candidateHashes)
+
+	for _, hashId := range candidateHashes {
+		if h, ok := algorithm.HashIdToHash(hashId); ok && h.Available() {
+			hash = h
+			break
+		}
+	}
+
+	// If the hash specified by config is a candidate, we'll use that.
+	if configuredHash.Available() {
+		for _, hashId := range candidateHashes {
+			if h, ok := algorithm.HashIdToHash(hashId); ok && h == configuredHash {
+				hash = h
+				break
+			}
+		}
+	}
+
+	if hash == 0 {
+		if len(acceptableHashes) > 0 {
+			if h, ok := algorithm.HashIdToHash(acceptableHashes[0]); ok {
+				hash = h
+			} else {
+				return 0, errors.UnsupportedError("no candidate hash functions are compiled in.")
+			}
+		} else {
+			return 0, errors.UnsupportedError("no candidate hash functions are compiled in.")
+		}
+	}
+	return
+}
+
+func acceptableHashesToWrite(singingKey *packet.PublicKey) []uint8 {
+	switch singingKey.PubKeyAlgo {
+	case packet.PubKeyAlgoEd448:
+		return []uint8{
+			hashToHashId(crypto.SHA512),
+			hashToHashId(crypto.SHA3_512),
+		}
+	case packet.PubKeyAlgoECDSA, packet.PubKeyAlgoEdDSA:
+		if curve, err := singingKey.Curve(); err == nil {
+			if curve == packet.Curve448 ||
+				curve == packet.CurveNistP521 ||
+				curve == packet.CurveBrainpoolP512 {
+				return []uint8{
+					hashToHashId(crypto.SHA512),
+					hashToHashId(crypto.SHA3_512),
+				}
+			} else if curve == packet.CurveBrainpoolP384 ||
+				curve == packet.CurveNistP384 {
+				return []uint8{
+					hashToHashId(crypto.SHA384),
+					hashToHashId(crypto.SHA512),
+					hashToHashId(crypto.SHA3_512),
+				}
+			}
+		}
+	}
+	return []uint8{
+		hashToHashId(crypto.SHA256),
+		hashToHashId(crypto.SHA384),
+		hashToHashId(crypto.SHA512),
+		hashToHashId(crypto.SHA3_256),
+		hashToHashId(crypto.SHA3_512),
+	}
+}

vendor/github.com/cenkalti/backoff/v4/context.go

@@ -1,62 +0,0 @@
-package backoff
-
-import (
-	"context"
-	"time"
-)
-
-// BackOffContext is a backoff policy that stops retrying after the context
-// is canceled.
-type BackOffContext interface { // nolint: golint
-	BackOff
-	Context() context.Context
-}
-
-type backOffContext struct {
-	BackOff
-	ctx context.Context
-}
-
-// WithContext returns a BackOffContext with context ctx
-//
-// ctx must not be nil
-func WithContext(b BackOff, ctx context.Context) BackOffContext { // nolint: golint
-	if ctx == nil {
-		panic("nil context")
-	}
-
-	if b, ok := b.(*backOffContext); ok {
-		return &backOffContext{
-			BackOff: b.BackOff,
-			ctx:     ctx,
-		}
-	}
-
-	return &backOffContext{
-		BackOff: b,
-		ctx:     ctx,
-	}
-}
-
-func getContext(b BackOff) context.Context {
-	if cb, ok := b.(BackOffContext); ok {
-		return cb.Context()
-	}
-	if tb, ok := b.(*backOffTries); ok {
-		return getContext(tb.delegate)
-	}
-	return context.Background()
-}
-
-func (b *backOffContext) Context() context.Context {
-	return b.ctx
-}
-
-func (b *backOffContext) NextBackOff() time.Duration {
-	select {
-	case <-b.ctx.Done():
-		return Stop
-	default:
-		return b.BackOff.NextBackOff()
-	}
-}

vendor/github.com/cenkalti/backoff/v4/exponential.go

@@ -1,216 +0,0 @@
-package backoff
-
-import (
-	"math/rand"
-	"time"
-)
-
-/*
-ExponentialBackOff is a backoff implementation that increases the backoff
-period for each retry attempt using a randomization function that grows exponentially.
-
-NextBackOff() is calculated using the following formula:
-
- randomized interval =
-     RetryInterval * (random value in range [1 - RandomizationFactor, 1 + RandomizationFactor])
-
-In other words NextBackOff() will range between the randomization factor
-percentage below and above the retry interval.
-
-For example, given the following parameters:
-
- RetryInterval = 2
- RandomizationFactor = 0.5
- Multiplier = 2
-
-the actual backoff period used in the next retry attempt will range between 1 and 3 seconds,
-multiplied by the exponential, that is, between 2 and 6 seconds.
-
-Note: MaxInterval caps the RetryInterval and not the randomized interval.
-
-If the time elapsed since an ExponentialBackOff instance is created goes past the
-MaxElapsedTime, then the method NextBackOff() starts returning backoff.Stop.
-
-The elapsed time can be reset by calling Reset().
-
-Example: Given the following default arguments, for 10 tries the sequence will be,
-and assuming we go over the MaxElapsedTime on the 10th try:
-
- Request #  RetryInterval (seconds)  Randomized Interval (seconds)
-
-  1          0.5                     [0.25,   0.75]
-  2          0.75                    [0.375,  1.125]
-  3          1.125                   [0.562,  1.687]
-  4          1.687                   [0.8435, 2.53]
-  5          2.53                    [1.265,  3.795]
-  6          3.795                   [1.897,  5.692]
-  7          5.692                   [2.846,  8.538]
-  8          8.538                   [4.269, 12.807]
-  9         12.807                   [6.403, 19.210]
- 10         19.210                   backoff.Stop
-
-Note: Implementation is not thread-safe.
-*/
-type ExponentialBackOff struct {
-	InitialInterval     time.Duration
-	RandomizationFactor float64
-	Multiplier          float64
-	MaxInterval         time.Duration
-	// After MaxElapsedTime the ExponentialBackOff returns Stop.
-	// It never stops if MaxElapsedTime == 0.
-	MaxElapsedTime time.Duration
-	Stop           time.Duration
-	Clock          Clock
-
-	currentInterval time.Duration
-	startTime       time.Time
-}
-
-// Clock is an interface that returns current time for BackOff.
-type Clock interface {
-	Now() time.Time
-}
-
-// ExponentialBackOffOpts is a function type used to configure ExponentialBackOff options.
-type ExponentialBackOffOpts func(*ExponentialBackOff)
-
-// Default values for ExponentialBackOff.
-const (
-	DefaultInitialInterval     = 500 * time.Millisecond
-	DefaultRandomizationFactor = 0.5
-	DefaultMultiplier          = 1.5
-	DefaultMaxInterval         = 60 * time.Second
-	DefaultMaxElapsedTime      = 15 * time.Minute
-)
-
-// NewExponentialBackOff creates an instance of ExponentialBackOff using default values.
-func NewExponentialBackOff(opts ...ExponentialBackOffOpts) *ExponentialBackOff {
-	b := &ExponentialBackOff{
-		InitialInterval:     DefaultInitialInterval,
-		RandomizationFactor: DefaultRandomizationFactor,
-		Multiplier:          DefaultMultiplier,
-		MaxInterval:         DefaultMaxInterval,
-		MaxElapsedTime:      DefaultMaxElapsedTime,
-		Stop:                Stop,
-		Clock:               SystemClock,
-	}
-	for _, fn := range opts {
-		fn(b)
-	}
-	b.Reset()
-	return b
-}
-
-// WithInitialInterval sets the initial interval between retries.
-func WithInitialInterval(duration time.Duration) ExponentialBackOffOpts {
-	return func(ebo *ExponentialBackOff) {
-		ebo.InitialInterval = duration
-	}
-}
-
-// WithRandomizationFactor sets the randomization factor to add jitter to intervals.
-func WithRandomizationFactor(randomizationFactor float64) ExponentialBackOffOpts {
-	return func(ebo *ExponentialBackOff) {
-		ebo.RandomizationFactor = randomizationFactor
-	}
-}
-
-// WithMultiplier sets the multiplier for increasing the interval after each retry.
-func WithMultiplier(multiplier float64) ExponentialBackOffOpts {
-	return func(ebo *ExponentialBackOff) {
-		ebo.Multiplier = multiplier
-	}
-}
-
-// WithMaxInterval sets the maximum interval between retries.
-func WithMaxInterval(duration time.Duration) ExponentialBackOffOpts {
-	return func(ebo *ExponentialBackOff) {
-		ebo.MaxInterval = duration
-	}
-}
-
-// WithMaxElapsedTime sets the maximum total time for retries.
-func WithMaxElapsedTime(duration time.Duration) ExponentialBackOffOpts {
-	return func(ebo *ExponentialBackOff) {
-		ebo.MaxElapsedTime = duration
-	}
-}
-
-// WithRetryStopDuration sets the duration after which retries should stop.
-func WithRetryStopDuration(duration time.Duration) ExponentialBackOffOpts {
-	return func(ebo *ExponentialBackOff) {
-		ebo.Stop = duration
-	}
-}
-
-// WithClockProvider sets the clock used to measure time.
-func WithClockProvider(clock Clock) ExponentialBackOffOpts {
-	return func(ebo *ExponentialBackOff) {
-		ebo.Clock = clock
-	}
-}
-
-type systemClock struct{}
-
-func (t systemClock) Now() time.Time {
-	return time.Now()
-}
-
-// SystemClock implements Clock interface that uses time.Now().
-var SystemClock = systemClock{}
-
-// Reset the interval back to the initial retry interval and restarts the timer.
-// Reset must be called before using b.
-func (b *ExponentialBackOff) Reset() {
-	b.currentInterval = b.InitialInterval
-	b.startTime = b.Clock.Now()
-}
-
-// NextBackOff calculates the next backoff interval using the formula:
-// 	Randomized interval = RetryInterval * (1 ± RandomizationFactor)
-func (b *ExponentialBackOff) NextBackOff() time.Duration {
-	// Make sure we have not gone over the maximum elapsed time.
-	elapsed := b.GetElapsedTime()
-	next := getRandomValueFromInterval(b.RandomizationFactor, rand.Float64(), b.currentInterval)
-	b.incrementCurrentInterval()
-	if b.MaxElapsedTime != 0 && elapsed+next > b.MaxElapsedTime {
-		return b.Stop
-	}
-	return next
-}
-
-// GetElapsedTime returns the elapsed time since an ExponentialBackOff instance
-// is created and is reset when Reset() is called.
-//
-// The elapsed time is computed using time.Now().UnixNano(). It is
-// safe to call even while the backoff policy is used by a running
-// ticker.
-func (b *ExponentialBackOff) GetElapsedTime() time.Duration {
-	return b.Clock.Now().Sub(b.startTime)
-}
-
-// Increments the current interval by multiplying it with the multiplier.
-func (b *ExponentialBackOff) incrementCurrentInterval() {
-	// Check for overflow, if overflow is detected set the current interval to the max interval.
-	if float64(b.currentInterval) >= float64(b.MaxInterval)/b.Multiplier {
-		b.currentInterval = b.MaxInterval
-	} else {
-		b.currentInterval = time.Duration(float64(b.currentInterval) * b.Multiplier)
-	}
-}
-
-// Returns a random value from the following interval:
-// 	[currentInterval - randomizationFactor * currentInterval, currentInterval + randomizationFactor * currentInterval].
-func getRandomValueFromInterval(randomizationFactor, random float64, currentInterval time.Duration) time.Duration {
-	if randomizationFactor == 0 {
-		return currentInterval // make sure no randomness is used when randomizationFactor is 0.
-	}
-	var delta = randomizationFactor * float64(currentInterval)
-	var minInterval = float64(currentInterval) - delta
-	var maxInterval = float64(currentInterval) + delta
-
-	// Get a random value from the range [minInterval, maxInterval].
-	// The formula used below has a +1 because if the minInterval is 1 and the maxInterval is 3 then
-	// we want a 33% chance for selecting either 1, 2 or 3.
-	return time.Duration(minInterval + (random * (maxInterval - minInterval + 1)))
-}

vendor/github.com/cenkalti/backoff/v4/retry.go

@@ -1,146 +0,0 @@
-package backoff
-
-import (
-	"errors"
-	"time"
-)
-
-// An OperationWithData is executing by RetryWithData() or RetryNotifyWithData().
-// The operation will be retried using a backoff policy if it returns an error.
-type OperationWithData[T any] func() (T, error)
-
-// An Operation is executing by Retry() or RetryNotify().
-// The operation will be retried using a backoff policy if it returns an error.
-type Operation func() error
-
-func (o Operation) withEmptyData() OperationWithData[struct{}] {
-	return func() (struct{}, error) {
-		return struct{}{}, o()
-	}
-}
-
-// Notify is a notify-on-error function. It receives an operation error and
-// backoff delay if the operation failed (with an error).
-//
-// NOTE that if the backoff policy stated to stop retrying,
-// the notify function isn't called.
-type Notify func(error, time.Duration)
-
-// Retry the operation o until it does not return error or BackOff stops.
-// o is guaranteed to be run at least once.
-//
-// If o returns a *PermanentError, the operation is not retried, and the
-// wrapped error is returned.
-//
-// Retry sleeps the goroutine for the duration returned by BackOff after a
-// failed operation returns.
-func Retry(o Operation, b BackOff) error {
-	return RetryNotify(o, b, nil)
-}
-
-// RetryWithData is like Retry but returns data in the response too.
-func RetryWithData[T any](o OperationWithData[T], b BackOff) (T, error) {
-	return RetryNotifyWithData(o, b, nil)
-}
-
-// RetryNotify calls notify function with the error and wait duration
-// for each failed attempt before sleep.
-func RetryNotify(operation Operation, b BackOff, notify Notify) error {
-	return RetryNotifyWithTimer(operation, b, notify, nil)
-}
-
-// RetryNotifyWithData is like RetryNotify but returns data in the response too.
-func RetryNotifyWithData[T any](operation OperationWithData[T], b BackOff, notify Notify) (T, error) {
-	return doRetryNotify(operation, b, notify, nil)
-}
-
-// RetryNotifyWithTimer calls notify function with the error and wait duration using the given Timer
-// for each failed attempt before sleep.
-// A default timer that uses system timer is used when nil is passed.
-func RetryNotifyWithTimer(operation Operation, b BackOff, notify Notify, t Timer) error {
-	_, err := doRetryNotify(operation.withEmptyData(), b, notify, t)
-	return err
-}
-
-// RetryNotifyWithTimerAndData is like RetryNotifyWithTimer but returns data in the response too.
-func RetryNotifyWithTimerAndData[T any](operation OperationWithData[T], b BackOff, notify Notify, t Timer) (T, error) {
-	return doRetryNotify(operation, b, notify, t)
-}
-
-func doRetryNotify[T any](operation OperationWithData[T], b BackOff, notify Notify, t Timer) (T, error) {
-	var (
-		err  error
-		next time.Duration
-		res  T
-	)
-	if t == nil {
-		t = &defaultTimer{}
-	}
-
-	defer func() {
-		t.Stop()
-	}()
-
-	ctx := getContext(b)
-
-	b.Reset()
-	for {
-		res, err = operation()
-		if err == nil {
-			return res, nil
-		}
-
-		var permanent *PermanentError
-		if errors.As(err, &permanent) {
-			return res, permanent.Err
-		}
-
-		if next = b.NextBackOff(); next == Stop {
-			if cerr := ctx.Err(); cerr != nil {
-				return res, cerr
-			}
-
-			return res, err
-		}
-
-		if notify != nil {
-			notify(err, next)
-		}
-
-		t.Start(next)
-
-		select {
-		case <-ctx.Done():
-			return res, ctx.Err()
-		case <-t.C():
-		}
-	}
-}
-
-// PermanentError signals that the operation should not be retried.
-type PermanentError struct {
-	Err error
-}
-
-func (e *PermanentError) Error() string {
-	return e.Err.Error()
-}
-
-func (e *PermanentError) Unwrap() error {
-	return e.Err
-}
-
-func (e *PermanentError) Is(target error) bool {
-	_, ok := target.(*PermanentError)
-	return ok
-}
-
-// Permanent wraps the given err in a *PermanentError.
-func Permanent(err error) error {
-	if err == nil {
-		return nil
-	}
-	return &PermanentError{
-		Err: err,
-	}
-}

vendor/github.com/cenkalti/backoff/v4/tries.go

@@ -1,38 +0,0 @@
-package backoff
-
-import "time"
-
-/*
-WithMaxRetries creates a wrapper around another BackOff, which will
-return Stop if NextBackOff() has been called too many times since
-the last time Reset() was called
-
-Note: Implementation is not thread-safe.
-*/
-func WithMaxRetries(b BackOff, max uint64) BackOff {
-	return &backOffTries{delegate: b, maxTries: max}
-}
-
-type backOffTries struct {
-	delegate BackOff
-	maxTries uint64
-	numTries uint64
-}
-
-func (b *backOffTries) NextBackOff() time.Duration {
-	if b.maxTries == 0 {
-		return Stop
-	}
-	if b.maxTries > 0 {
-		if b.maxTries <= b.numTries {
-			return Stop
-		}
-		b.numTries++
-	}
-	return b.delegate.NextBackOff()
-}
-
-func (b *backOffTries) Reset() {
-	b.numTries = 0
-	b.delegate.Reset()
-}

vendor/github.com/cenkalti/backoff/v5/CHANGELOG.md

@@ -0,0 +1,29 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [5.0.0] - 2024-12-19
+
+### Added
+
+- RetryAfterError can be returned from an operation to indicate how long to wait before the next retry.
+
+### Changed
+
+- Retry function now accepts additional options for specifying max number of tries and max elapsed time.
+- Retry function now accepts a context.Context.
+- Operation function signature changed to return result (any type) and error.
+
+### Removed
+
+- RetryNotify* and RetryWithData functions. Only single Retry function remains.
+- Optional arguments from ExponentialBackoff constructor.
+- Clock and Timer interfaces.
+
+### Fixed
+
+- The original error is returned from Retry if there's a PermanentError. (#144)
+- The Retry function respects the wrapped PermanentError. (#140)

vendor/github.com/cenkalti/backoff/v5/README.md

@@ -1,4 +1,4 @@
-# Exponential Backoff [![GoDoc][godoc image]][godoc] [![Coverage Status][coveralls image]][coveralls]
+# Exponential Backoff [![GoDoc][godoc image]][godoc]
 
 This is a Go port of the exponential backoff algorithm from [Google's HTTP Client Library for Java][google-http-java-client].
 
@@ -9,9 +9,11 @@ The retries exponentially increase and stop increasing when a certain threshold
 
 ## Usage
 
-Import path is `github.com/cenkalti/backoff/v4`. Please note the version part at the end.
+Import path is `github.com/cenkalti/backoff/v5`. Please note the version part at the end.
 
-Use https://pkg.go.dev/github.com/cenkalti/backoff/v4 to view the documentation.
+For most cases, use `Retry` function. See [example_test.go][example] for an example.
+
+If you have specific needs, copy `Retry` function (from [retry.go][retry-src]) into your code and modify it as needed.
 
 ## Contributing
 
@@ -19,12 +21,11 @@ Use https://pkg.go.dev/github.com/cenkalti/backoff/v4 to view the documentation.
 * Please don't send a PR without opening an issue and discussing it first.
 * If proposed change is not a common use case, I will probably not accept it.
 
-[godoc]: https://pkg.go.dev/github.com/cenkalti/backoff/v4
+[godoc]: https://pkg.go.dev/github.com/cenkalti/backoff/v5
 [godoc image]: https://godoc.org/github.com/cenkalti/backoff?status.png
-[coveralls]: https://coveralls.io/github/cenkalti/backoff?branch=master
-[coveralls image]: https://coveralls.io/repos/github/cenkalti/backoff/badge.svg?branch=master
 
 [google-http-java-client]: https://github.com/google/google-http-java-client/blob/da1aa993e90285ec18579f1553339b00e19b3ab5/google-http-client/src/main/java/com/google/api/client/util/ExponentialBackOff.java
 [exponential backoff wiki]: http://en.wikipedia.org/wiki/Exponential_backoff
 
-[advanced example]: https://pkg.go.dev/github.com/cenkalti/backoff/v4?tab=doc#pkg-examples
+[retry-src]: https://github.com/cenkalti/backoff/blob/v5/retry.go
+[example]: https://github.com/cenkalti/backoff/blob/v5/example_test.go

vendor/github.com/cenkalti/backoff/v5/backoff.go

@@ -15,16 +15,16 @@ import "time"
 // BackOff is a backoff policy for retrying an operation.
 type BackOff interface {
 	// NextBackOff returns the duration to wait before retrying the operation,
-	// or backoff. Stop to indicate that no more retries should be made.
+	// backoff.Stop to indicate that no more retries should be made.
 	//
 	// Example usage:
 	//
-	// 	duration := backoff.NextBackOff();
-	// 	if (duration == backoff.Stop) {
-	// 		// Do not retry operation.
-	// 	} else {
-	// 		// Sleep for duration and retry operation.
-	// 	}
+	//     duration := backoff.NextBackOff()
+	//     if duration == backoff.Stop {
+	//         // Do not retry operation.
+	//     } else {
+	//         // Sleep for duration and retry operation.
+	//     }
 	//
 	NextBackOff() time.Duration
 

vendor/github.com/cenkalti/backoff/v5/error.go

@@ -0,0 +1,46 @@
+package backoff
+
+import (
+	"fmt"
+	"time"
+)
+
+// PermanentError signals that the operation should not be retried.
+type PermanentError struct {
+	Err error
+}
+
+// Permanent wraps the given err in a *PermanentError.
+func Permanent(err error) error {
+	if err == nil {
+		return nil
+	}
+	return &PermanentError{
+		Err: err,
+	}
+}
+
+// Error returns a string representation of the Permanent error.
+func (e *PermanentError) Error() string {
+	return e.Err.Error()
+}
+
+// Unwrap returns the wrapped error.
+func (e *PermanentError) Unwrap() error {
+	return e.Err
+}
+
+// RetryAfterError signals that the operation should be retried after the given duration.
+type RetryAfterError struct {
+	Duration time.Duration
+}
+
+// RetryAfter returns a RetryAfter error that specifies how long to wait before retrying.
+func RetryAfter(seconds int) error {
+	return &RetryAfterError{Duration: time.Duration(seconds) * time.Second}
+}
+
+// Error returns a string representation of the RetryAfter error.
+func (e *RetryAfterError) Error() string {
+	return fmt.Sprintf("retry after %s", e.Duration)
+}

vendor/github.com/cenkalti/backoff/v5/exponential.go

@@ -0,0 +1,118 @@
+package backoff
+
+import (
+	"math/rand/v2"
+	"time"
+)
+
+/*
+ExponentialBackOff is a backoff implementation that increases the backoff
+period for each retry attempt using a randomization function that grows exponentially.
+
+NextBackOff() is calculated using the following formula:
+
+	randomized interval =
+	    RetryInterval * (random value in range [1 - RandomizationFactor, 1 + RandomizationFactor])
+
+In other words NextBackOff() will range between the randomization factor
+percentage below and above the retry interval.
+
+For example, given the following parameters:
+
+	RetryInterval = 2
+	RandomizationFactor = 0.5
+	Multiplier = 2
+
+the actual backoff period used in the next retry attempt will range between 1 and 3 seconds,
+multiplied by the exponential, that is, between 2 and 6 seconds.
+
+Note: MaxInterval caps the RetryInterval and not the randomized interval.
+
+Example: Given the following default arguments, for 9 tries the sequence will be:
+
+	Request #  RetryInterval (seconds)  Randomized Interval (seconds)
+
+	 1          0.5                     [0.25,   0.75]
+	 2          0.75                    [0.375,  1.125]
+	 3          1.125                   [0.562,  1.687]
+	 4          1.687                   [0.8435, 2.53]
+	 5          2.53                    [1.265,  3.795]
+	 6          3.795                   [1.897,  5.692]
+	 7          5.692                   [2.846,  8.538]
+	 8          8.538                   [4.269, 12.807]
+	 9         12.807                   [6.403, 19.210]
+
+Note: Implementation is not thread-safe.
+*/
+type ExponentialBackOff struct {
+	InitialInterval     time.Duration
+	RandomizationFactor float64
+	Multiplier          float64
+	MaxInterval         time.Duration
+
+	currentInterval time.Duration
+}
+
+// Default values for ExponentialBackOff.
+const (
+	DefaultInitialInterval     = 500 * time.Millisecond
+	DefaultRandomizationFactor = 0.5
+	DefaultMultiplier          = 1.5
+	DefaultMaxInterval         = 60 * time.Second
+)
+
+// NewExponentialBackOff creates an instance of ExponentialBackOff using default values.
+func NewExponentialBackOff() *ExponentialBackOff {
+	return &ExponentialBackOff{
+		InitialInterval:     DefaultInitialInterval,
+		RandomizationFactor: DefaultRandomizationFactor,
+		Multiplier:          DefaultMultiplier,
+		MaxInterval:         DefaultMaxInterval,
+	}
+}
+
+// Reset the interval back to the initial retry interval and restarts the timer.
+// Reset must be called before using b.
+func (b *ExponentialBackOff) Reset() {
+	b.currentInterval = b.InitialInterval
+}
+
+// NextBackOff calculates the next backoff interval using the formula:
+//
+//	Randomized interval = RetryInterval * (1 ± RandomizationFactor)
+func (b *ExponentialBackOff) NextBackOff() time.Duration {
+	if b.currentInterval == 0 {
+		b.currentInterval = b.InitialInterval
+	}
+
+	next := getRandomValueFromInterval(b.RandomizationFactor, rand.Float64(), b.currentInterval)
+	b.incrementCurrentInterval()
+	return next
+}
+
+// Increments the current interval by multiplying it with the multiplier.
+func (b *ExponentialBackOff) incrementCurrentInterval() {
+	// Check for overflow, if overflow is detected set the current interval to the max interval.
+	if float64(b.currentInterval) >= float64(b.MaxInterval)/b.Multiplier {
+		b.currentInterval = b.MaxInterval
+	} else {
+		b.currentInterval = time.Duration(float64(b.currentInterval) * b.Multiplier)
+	}
+}
+
+// Returns a random value from the following interval:
+//
+//	[currentInterval - randomizationFactor * currentInterval, currentInterval + randomizationFactor * currentInterval].
+func getRandomValueFromInterval(randomizationFactor, random float64, currentInterval time.Duration) time.Duration {
+	if randomizationFactor == 0 {
+		return currentInterval // make sure no randomness is used when randomizationFactor is 0.
+	}
+	var delta = randomizationFactor * float64(currentInterval)
+	var minInterval = float64(currentInterval) - delta
+	var maxInterval = float64(currentInterval) + delta
+
+	// Get a random value from the range [minInterval, maxInterval].
+	// The formula used below has a +1 because if the minInterval is 1 and the maxInterval is 3 then
+	// we want a 33% chance for selecting either 1, 2 or 3.
+	return time.Duration(minInterval + (random * (maxInterval - minInterval + 1)))
+}