fix: ensure $ABRA_DIR/servers is 0600

Also remove deprecated folders while I'm here: `vendor` / `backup`

See #580

.drone.yml

@@ -60,7 +60,31 @@ steps:
       - make check
       - make test
 
-  - name: integration test
+  - name: on-demand integration test
+    image: appleboy/drone-ssh
+    settings:
+      host:
+        - int.coopcloud.tech
+      username: abra
+      key:
+        from_secret: abra_int_private_key
+      port: 22
+      command_timeout: 60m
+      script_stop: true
+      request_pty: true
+      script:
+        - |
+          wget https://git.coopcloud.tech/toolshed/abra/raw/branch/main/scripts/tests/run-ci-int -O run-ci-int
+          chmod +x run-ci-int
+          sh run-ci-int
+    when:
+      ref:
+        - refs/heads/int-*
+    depends_on:
+      - make check
+      - make test
+
+  - name: nightly integration test
     image: appleboy/drone-ssh
     settings:
       host:
@@ -87,3 +111,8 @@ steps:
 volumes:
   - name: deps
     temp: {}
+
+trigger:
+  action:
+    exclude:
+      - synchronized

.envrc.sample

@@ -1,6 +1,6 @@
 # integration test suite
 # export ABRA_DIR="$HOME/.abra_test"
-# export ABRA_TEST_DOMAIN=test.example.com
+# export TEST_SERVER=test.example.com
 # export ABRA_CI=1
 
 # release automation

cli/app/app.go

@@ -1,11 +1,12 @@
 package app
 
 import (
+	"github.com/leonelquinteros/gotext"
 	"github.com/spf13/cobra"
 )
 
 var AppCommand = &cobra.Command{
 	Use:     "app [cmd] [args] [flags]",
 	Aliases: []string{"a"},
-	Short:   "Manage apps",
+	Short:   gotext.Get("Manage apps"),
 }

cli/app/cmd.go

@@ -183,7 +183,7 @@ does not).`,
 		if err := internal.RunCmdRemote(
 			cl,
 			app,
-			requestTTY,
+			disableTTY,
 			app.Recipe.AbraShPath,
 			targetServiceName, cmdName, parsedCmdArgs, remoteUser); err != nil {
 			log.Fatal(err)
@@ -238,7 +238,7 @@ func parseCmdArgs(args []string, isLocal bool) (bool, string) {
 var (
 	local      bool
 	remoteUser string
-	requestTTY bool
+	disableTTY bool
 )
 
 func init() {
@@ -259,11 +259,11 @@ func init() {
 	)
 
 	AppCmdCommand.Flags().BoolVarP(
-		&requestTTY,
+		&disableTTY,
 		"tty",
 		"T",
 		false,
-		"request remote TTY",
+		"disable remote TTY",
 	)
 
 	AppCmdCommand.Flags().BoolVarP(

cli/app/cp.go

@@ -33,7 +33,7 @@ var AppCpCommand = &cobra.Command{
   abra app cp 1312.net myfile.txt app:/
 
   # copy that file back to your current working directory locally
-  abra app cp 1312.net app:/myfile.txt`,
+  abra app cp 1312.net app:/myfile.txt ./`,
 	Args: cobra.ExactArgs(3),
 	ValidArgsFunction: func(
 		cmd *cobra.Command,

cli/app/deploy.go

@@ -108,7 +108,11 @@ checkout as-is. Recipe commit hashes are also supported as values for
 		}
 
 		if err := lint.LintForErrors(app.Recipe); err != nil {
-			log.Fatal(err)
+			if internal.Chaos {
+				log.Warn(err)
+			} else {
+				log.Fatal(err)
+			}
 		}
 
 		if err := validateSecrets(cl, app); err != nil {
@@ -197,7 +201,25 @@ checkout as-is. Recipe commit hashes are also supported as values for
 
 		log.Debugf("set waiting timeout to %d second(s)", stack.WaitTimeout)
 
-		if err := stack.RunDeploy(cl, deployOpts, compose, app.Name, internal.DontWaitConverge); err != nil {
+		serviceNames, err := appPkg.GetAppServiceNames(app.Name)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		f, err := app.Filters(true, false, serviceNames...)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		if err := stack.RunDeploy(
+			cl,
+			deployOpts,
+			compose,
+			app.Name,
+			app.Server,
+			internal.DontWaitConverge,
+			f,
+		); err != nil {
 			log.Fatal(err)
 		}
 

cli/app/list.go

@@ -142,10 +142,14 @@ Use "--status/-S" flag to query all servers for the live deployment status.`,
 					appStats.AutoUpdate = autoUpdate
 
 					var newUpdates []string
-					if version != "unknown" {
+					if version != "unknown" && chaos == "false" {
+						if err := app.Recipe.EnsureExists(); err != nil {
+							log.Fatalf("unable to clone %s: %s", app.Name, err)
+						}
+
 						updates, err := app.Recipe.Tags()
 						if err != nil {
-							log.Fatal(err)
+							log.Fatalf("unable to retrieve tags for %s: %s", app.Name, err)
 						}
 
 						parsedVersion, err := tagcmp.Parse(version)

cli/app/logs.go

@@ -3,23 +3,14 @@ package app
 import (
 	"context"
 	"fmt"
-	"io"
-	"os"
-	"slices"
-	"sync"
-	"time"
 
 	"coopcloud.tech/abra/cli/internal"
 	appPkg "coopcloud.tech/abra/pkg/app"
 	"coopcloud.tech/abra/pkg/autocomplete"
 	"coopcloud.tech/abra/pkg/client"
 	"coopcloud.tech/abra/pkg/log"
+	"coopcloud.tech/abra/pkg/logs"
 	"coopcloud.tech/abra/pkg/upstream/stack"
-	"github.com/docker/docker/api/types"
-	containerTypes "github.com/docker/docker/api/types/container"
-	"github.com/docker/docker/api/types/filters"
-	"github.com/docker/docker/api/types/swarm"
-	dockerClient "github.com/docker/docker/client"
 	"github.com/spf13/cobra"
 )
 
@@ -73,80 +64,25 @@ var AppLogsCommand = &cobra.Command{
 			serviceNames = []string{args[1]}
 		}
 
-		if err = tailLogs(cl, app, serviceNames); err != nil {
+		f, err := app.Filters(true, false, serviceNames...)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		opts := logs.TailOpts{
+			AppName:  app.Name,
+			Services: serviceNames,
+			StdErr:   stdErr,
+			Since:    sinceLogs,
+			Filters:  f,
+		}
+
+		if err := logs.TailLogs(cl, opts); err != nil {
 			log.Fatal(err)
 		}
 	},
 }
 
-// tailLogs prints logs for the given app with optional service names to be
-// filtered on. It also checks if the latest task is not runnning and then
-// prints the past tasks.
-func tailLogs(cl *dockerClient.Client, app appPkg.App, serviceNames []string) error {
-	f, err := app.Filters(true, false, serviceNames...)
-	if err != nil {
-		return err
-	}
-
-	services, err := cl.ServiceList(context.Background(), types.ServiceListOptions{Filters: f})
-	if err != nil {
-		return err
-	}
-
-	var wg sync.WaitGroup
-	for _, service := range services {
-		filters := filters.NewArgs()
-		filters.Add("name", service.Spec.Name)
-		tasks, err := cl.TaskList(context.Background(), types.TaskListOptions{Filters: f})
-		if err != nil {
-			return err
-		}
-		if len(tasks) > 0 {
-			// Need to sort the tasks by the CreatedAt field in the inverse order.
-			// Otherwise they are in the reversed order and not sorted properly.
-			slices.SortFunc[[]swarm.Task](tasks, func(t1, t2 swarm.Task) int {
-				return int(t2.Meta.CreatedAt.Unix() - t1.Meta.CreatedAt.Unix())
-			})
-			lastTask := tasks[0].Status
-			if lastTask.State != swarm.TaskStateRunning {
-				for _, task := range tasks {
-					log.Errorf("[%s] %s State %s: %s", service.Spec.Name, task.Meta.CreatedAt.Format(time.RFC3339), task.Status.State, task.Status.Err)
-				}
-			}
-		}
-
-		// Collect the logs in a go routine, so the logs from all services are
-		// collected in parallel.
-		wg.Add(1)
-		go func(serviceID string) {
-			logs, err := cl.ServiceLogs(context.Background(), serviceID, containerTypes.LogsOptions{
-				ShowStderr: true,
-				ShowStdout: !stdErr,
-				Since:      sinceLogs,
-				Until:      "",
-				Timestamps: true,
-				Follow:     true,
-				Tail:       "20",
-				Details:    false,
-			})
-			if err != nil {
-				log.Fatal(err)
-			}
-			defer logs.Close()
-
-			_, err = io.Copy(os.Stdout, logs)
-			if err != nil && err != io.EOF {
-				log.Fatal(err)
-			}
-		}(service.ID)
-	}
-
-	// Wait for all log streams to be closed.
-	wg.Wait()
-
-	return nil
-}
-
 var (
 	stdErr    bool
 	sinceLogs string

cli/app/new.go

@@ -109,6 +109,15 @@ var AppNewCommand = &cobra.Command{
 				if err := recipe.EnsureLatest(); err != nil {
 					log.Fatal(err)
 				}
+
+				if recipeVersion == "" {
+					head, err := recipe.Head()
+					if err != nil {
+						log.Fatalf("failed to retrieve latest commit for %s: %s", recipe.Name, err)
+					}
+
+					recipeVersion = formatter.SmallSHA(head.String())
+				}
 			}
 		}
 
@@ -185,7 +194,7 @@ var AppNewCommand = &cobra.Command{
 			newAppServer = "local"
 		}
 
-		log.Infof("%s created successfully (version: %s, chaos: %s)", appDomain, recipeVersion, chaosVersion)
+		log.Infof("%s created (version: %s)", appDomain, recipeVersion)
 
 		if len(appSecrets) > 0 {
 			rows := [][]string{}
@@ -293,6 +302,12 @@ func ensureServerFlag() error {
 		return err
 	}
 
+	if len(servers) == 1 {
+		newAppServer = servers[0]
+		log.Infof("single server detected, choosing %s automatically", newAppServer)
+		return nil
+	}
+
 	if newAppServer == "" && !internal.NoInput {
 		prompt := &survey.Select{
 			Message: "Select app server:",

cli/app/ps.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"sort"
 	"strings"
 
 	"coopcloud.tech/abra/cli/internal"
@@ -91,9 +92,14 @@ func showPSOutput(app appPkg.App, cl *dockerClient.Client, deployedVersion, chao
 		return
 	}
 
+	services := compose.Services
+	sort.Slice(services, func(i, j int) bool {
+		return services[i].Name < services[j].Name
+	})
+
 	var rows [][]string
 	allContainerStats := make(map[string]map[string]string)
-	for _, service := range compose.Services {
+	for _, service := range services {
 		filters := filters.NewArgs()
 		filters.Add("name", fmt.Sprintf("^%s_%s", app.StackName(), service.Name))
 

cli/app/restart.go

@@ -9,8 +9,10 @@ import (
 	"coopcloud.tech/abra/pkg/autocomplete"
 	"coopcloud.tech/abra/pkg/client"
 	"coopcloud.tech/abra/pkg/log"
+	"coopcloud.tech/abra/pkg/ui"
 	upstream "coopcloud.tech/abra/pkg/upstream/service"
 	stack "coopcloud.tech/abra/pkg/upstream/stack"
+	"github.com/docker/docker/api/types"
 	"github.com/spf13/cobra"
 )
 
@@ -93,13 +95,36 @@ Pass "--all-services/-a" to restart all services.`,
 		for _, serviceName := range serviceNames {
 			stackServiceName := fmt.Sprintf("%s_%s", app.StackName(), serviceName)
 
+			service, _, err := cl.ServiceInspectWithRaw(
+				context.Background(),
+				stackServiceName,
+				types.ServiceInspectOptions{},
+			)
+			if err != nil {
+				log.Fatal(err)
+			}
+
 			log.Debugf("attempting to scale %s to 0", stackServiceName)
 
 			if err := upstream.RunServiceScale(context.Background(), cl, stackServiceName, 0); err != nil {
 				log.Fatal(err)
 			}
 
-			if err := stack.WaitOnService(context.Background(), cl, stackServiceName, app.Name); err != nil {
+			f, err := app.Filters(true, false, serviceName)
+			if err != nil {
+				log.Fatal(err)
+			}
+
+			waitOpts := stack.WaitOpts{
+				Services:   []ui.ServiceMeta{{Name: stackServiceName, ID: service.ID}},
+				AppName:    app.Name,
+				ServerName: app.Server,
+				Filters:    f,
+				NoLog:      true,
+				Quiet:      true,
+			}
+
+			if err := stack.WaitOnServices(cmd.Context(), cl, waitOpts); err != nil {
 				log.Fatal(err)
 			}
 
@@ -110,7 +135,7 @@ Pass "--all-services/-a" to restart all services.`,
 				log.Fatal(err)
 			}
 
-			if err := stack.WaitOnService(context.Background(), cl, stackServiceName, app.Name); err != nil {
+			if err := stack.WaitOnServices(cmd.Context(), cl, waitOpts); err != nil {
 				log.Fatal(err)
 			}
 

cli/app/rollback.go

@@ -194,7 +194,32 @@ beforehand. See "abra app backup" for more.`,
 			log.Fatal(err)
 		}
 
-		if err := stack.RunDeploy(cl, deployOpts, compose, stackName, internal.DontWaitConverge); err != nil {
+		stack.WaitTimeout, err = appPkg.GetTimeoutFromLabel(compose, stackName)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		log.Debugf("set waiting timeout to %d second(s)", stack.WaitTimeout)
+
+		serviceNames, err := appPkg.GetAppServiceNames(app.Name)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		f, err := app.Filters(true, false, serviceNames...)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		if err := stack.RunDeploy(
+			cl,
+			deployOpts,
+			compose,
+			stackName,
+			app.Server,
+			internal.DontWaitConverge,
+			f,
+		); err != nil {
 			log.Fatal(err)
 		}
 

cli/app/secret.go

@@ -233,6 +233,7 @@ var AppSecretRmCommand = &cobra.Command{
 	Use:     "remove <domain> [[secret] | --all] [flags]",
 	Aliases: []string{"rm"},
 	Short:   "Remove a secret",
+	Example: "  abra app secret rm 1312.net oauth_key",
 	Args:    cobra.RangeArgs(1, 2),
 	ValidArgsFunction: func(
 		cmd *cobra.Command,

cli/app/undeploy.go

@@ -64,6 +64,24 @@ Passing "--prune/-p" does not remove those volumes.`,
 			log.Fatal(err)
 		}
 
+		composeFiles, err := app.Recipe.GetComposeFiles(app.Env)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		opts := stack.Deploy{Composefiles: composeFiles, Namespace: stackName}
+		compose, err := appPkg.GetAppComposeConfig(app.Name, opts, app.Env)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		stack.WaitTimeout, err = appPkg.GetTimeoutFromLabel(compose, stackName)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		log.Info("initialising undeploy")
+
 		rmOpts := stack.Remove{
 			Namespaces: []string{stackName},
 			Detach:     false,
@@ -78,6 +96,8 @@ Passing "--prune/-p" does not remove those volumes.`,
 			}
 		}
 
+		log.Info("undeploy succeeded 🟢")
+
 		if err := app.WriteRecipeVersion(deployMeta.Version, false); err != nil {
 			log.Fatalf("writing recipe version failed: %s", err)
 		}

cli/app/upgrade.go

@@ -3,6 +3,7 @@ package app
 import (
 	"context"
 	"fmt"
+	"strings"
 
 	"coopcloud.tech/abra/cli/internal"
 	"coopcloud.tech/abra/pkg/app"
@@ -14,6 +15,7 @@ import (
 	"coopcloud.tech/abra/pkg/formatter"
 	"coopcloud.tech/abra/pkg/lint"
 	"coopcloud.tech/abra/pkg/log"
+	"coopcloud.tech/abra/pkg/recipe"
 	stack "coopcloud.tech/abra/pkg/upstream/stack"
 	"coopcloud.tech/tagcmp"
 	"github.com/AlecAivazis/survey/v2"
@@ -69,7 +71,13 @@ beforehand. See "abra app backup" for more.`,
 
 		app := internal.ValidateApp(args)
 
-		if err := app.Recipe.Ensure(internal.GetEnsureContext()); err != nil {
+		if err := app.Recipe.Ensure(recipe.EnsureContext{
+			Chaos:   internal.Chaos,
+			Offline: internal.Offline,
+			// Ignore the env version for now, to make sure we are at the latest commit.
+			// This enables us to get release notes, that were added after a release.
+			IgnoreEnvVersion: true,
+		}); err != nil {
 			log.Fatal(err)
 		}
 
@@ -142,10 +150,9 @@ beforehand. See "abra app backup" for more.`,
 
 		log.Debugf("choosing %s as version to upgrade", chosenUpgrade)
 
-		// NOTE(d1): if release notes written after git tag published, read them
-		// before we check out the tag and then they'll appear to be missing. this
-		// covers when we obviously will forget to write release notes before
-		// publishing
+		// Get the release notes before checking out the new version in the
+		// recipe. This enables us to get release notes, that were added after
+		// a release.
 		if err := getReleaseNotes(app, versions, chosenUpgrade, deployMeta, &upgradeReleaseNotes); err != nil {
 			log.Fatal(err)
 		}
@@ -207,9 +214,7 @@ beforehand. See "abra app backup" for more.`,
 			return
 		}
 
-		if upgradeReleaseNotes != "" && chosenUpgrade != "" {
-			fmt.Print(upgradeReleaseNotes)
-		} else {
+		if upgradeReleaseNotes == "" {
 			upgradeWarnMessages = append(
 				upgradeWarnMessages,
 				fmt.Sprintf("no release notes available for %s", chosenUpgrade),
@@ -233,7 +238,25 @@ beforehand. See "abra app backup" for more.`,
 
 		log.Debugf("set waiting timeout to %d second(s)", stack.WaitTimeout)
 
-		if err := stack.RunDeploy(cl, deployOpts, compose, stackName, internal.DontWaitConverge); err != nil {
+		serviceNames, err := appPkg.GetAppServiceNames(app.Name)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		f, err := app.Filters(true, false, serviceNames...)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		if err := stack.RunDeploy(
+			cl,
+			deployOpts,
+			compose,
+			stackName,
+			app.Server,
+			internal.DontWaitConverge,
+			f,
+		); err != nil {
 			log.Fatal(err)
 		}
 
@@ -313,6 +336,11 @@ func getReleaseNotes(
 			}
 
 			if note != "" {
+				// NOTE(d1): trim any final newline on the end of the note itself before
+				//           we manually handle newlines (for multiple release notes and
+				//           ensuring space between the warning messages)
+				note = strings.TrimSuffix(note, "\n")
+
 				*upgradeReleaseNotes += fmt.Sprintf("%s\n", note)
 			}
 		}

cli/internal/command.go

@@ -24,7 +24,7 @@ import (
 func RunCmdRemote(
 	cl *dockerClient.Client,
 	app appPkg.App,
-	requestTTY bool,
+	disableTTY bool,
 	abraSh, serviceName, cmdName, cmdArgs, remoteUser string) error {
 	filters := filters.NewArgs()
 	filters.Add("name", fmt.Sprintf("^%s_%s", app.StackName(), serviceName))
@@ -84,8 +84,10 @@ func RunCmdRemote(
 	}
 
 	execCreateOpts.Cmd = cmd
-	execCreateOpts.Tty = requestTTY
-	if !requestTTY {
+
+	execCreateOpts.Tty = true
+	if disableTTY {
+		execCreateOpts.Tty = false
 		log.Debugf("not requesting a remote TTY")
 	}
 

cli/internal/deploy.go

@@ -46,7 +46,7 @@ func DeployOverview(
 	app appPkg.App,
 	deployedVersion string,
 	toDeployVersion string,
-	info string,
+	releaseNotes string,
 	warnMessages []string,
 ) error {
 	deployConfig := "compose.yml"
@@ -85,8 +85,8 @@ func DeployOverview(
 
 	fmt.Println(overview)
 
-	if info != "" {
-		fmt.Println(info)
+	if releaseNotes != "" {
+		fmt.Print(releaseNotes)
 	}
 
 	for _, msg := range warnMessages {

cli/internal/validate.go

@@ -32,12 +32,12 @@ func ValidateRecipe(args []string, cmdName string) recipe.Recipe {
 
 		localRecipes, err := recipe.GetRecipesLocal()
 		if err != nil {
-			log.Fatal(err)
-		}
-
-		for _, recipeLocal := range localRecipes {
-			if _, ok := knownRecipes[recipeLocal]; !ok {
-				knownRecipes[recipeLocal] = true
+			log.Debugf("can't read local recipes: %s", err)
+		} else {
+			for _, recipeLocal := range localRecipes {
+				if _, ok := knownRecipes[recipeLocal]; !ok {
+					knownRecipes[recipeLocal] = true
+				}
 			}
 		}
 

cli/recipe/fetch.go

@@ -1,11 +1,15 @@
 package recipe
 
 import (
+	"os"
+
 	"coopcloud.tech/abra/cli/internal"
 	"coopcloud.tech/abra/pkg/autocomplete"
 	"coopcloud.tech/abra/pkg/formatter"
 	"coopcloud.tech/abra/pkg/log"
 	"coopcloud.tech/abra/pkg/recipe"
+	"github.com/go-git/go-git/v5"
+	gitCfg "github.com/go-git/go-git/v5/config"
 	"github.com/spf13/cobra"
 )
 
@@ -13,7 +17,16 @@ var RecipeFetchCommand = &cobra.Command{
 	Use:     "fetch [recipe | --all] [flags]",
 	Aliases: []string{"f"},
 	Short:   "Clone recipe(s) locally",
+	Long:    `Using "--force/-f" Git syncs an existing recipe. It does not erase unstaged changes.`,
 	Args:    cobra.RangeArgs(0, 1),
+	Example: `  # fetch from recipe catalogue
+  abra recipe fetch gitea
+
+  # fetch from remote recipe
+  abra recipe fetch git.foo.org/recipes/myrecipe
+
+  # fetch with ssh remote for hacking
+  abra recipe fetch gitea --ssh`,
 	ValidArgsFunction: func(
 		cmd *cobra.Command,
 		args []string,
@@ -36,10 +49,39 @@ var RecipeFetchCommand = &cobra.Command{
 
 		ensureCtx := internal.GetEnsureContext()
 		if recipeName != "" {
-			r := internal.ValidateRecipe(args, cmd.Name())
-			if err := r.Ensure(ensureCtx); err != nil {
-				log.Fatal(err)
+			r := recipe.Get(recipeName)
+			if _, err := os.Stat(r.Dir); !os.IsNotExist(err) {
+				if !force {
+					log.Warnf("%s is already fetched", r.Name)
+					return
+				}
 			}
+
+			r = internal.ValidateRecipe(args, cmd.Name())
+
+			if sshRemote {
+				if r.SSHURL == "" {
+					log.Warnf("unable to discover SSH remote for %s", r.Name)
+					return
+				}
+
+				repo, err := git.PlainOpen(r.Dir)
+				if err != nil {
+					log.Fatalf("unable to open %s: %s", r.Dir, err)
+				}
+
+				if err = repo.DeleteRemote("origin"); err != nil {
+					log.Fatalf("unable to remove default remote in %s: %s", r.Dir, err)
+				}
+
+				if _, err := repo.CreateRemote(&gitCfg.RemoteConfig{
+					Name: "origin",
+					URLs: []string{r.SSHURL},
+				}); err != nil {
+					log.Fatalf("unable to set SSH remote in %s: %s", r.Dir, err)
+				}
+			}
+
 			return
 		}
 
@@ -61,6 +103,8 @@ var RecipeFetchCommand = &cobra.Command{
 
 var (
 	fetchAllRecipes bool
+	sshRemote       bool
+	force           bool
 )
 
 func init() {
@@ -71,4 +115,20 @@ func init() {
 		false,
 		"fetch all recipes",
 	)
+
+	RecipeFetchCommand.Flags().BoolVarP(
+		&sshRemote,
+		"ssh",
+		"s",
+		false,
+		"automatically set ssh remote",
+	)
+
+	RecipeFetchCommand.Flags().BoolVarP(
+		&force,
+		"force",
+		"f",
+		false,
+		"force re-fetch",
+	)
 }

cli/run.go

@@ -31,20 +31,21 @@ func Run(version, commit string) {
 			"upgrade",
 		},
 		PersistentPreRun: func(cmd *cobra.Command, args []string) {
-			paths := []string{
-				config.ABRA_DIR,
-				config.SERVERS_DIR,
-				config.RECIPES_DIR,
-				config.VENDOR_DIR, // TODO(d1): remove > 0.9.x
-				config.BACKUP_DIR, // TODO(d1): remove > 0.9.x
+			dirs := []map[string]os.FileMode{
+				{config.ABRA_DIR: 0764},
+				{config.SERVERS_DIR: 0600},
+				{config.RECIPES_DIR: 0764},
+				{config.LOGS_DIR: 0764},
 			}
 
-			for _, path := range paths {
-				if err := os.Mkdir(path, 0764); err != nil {
-					if !os.IsExist(err) {
-						log.Fatal(err)
+			for _, dir := range dirs {
+				for path, perm := range dir {
+					if err := os.Mkdir(path, perm); err != nil {
+						if !os.IsExist(err) {
+							log.Fatal(err)
+						}
+						continue
 					}
-					continue
 				}
 			}
 

cli/server/add.go

@@ -103,8 +103,7 @@ developer machine. The domain is then set to "default".`,
 
 		if _, err := client.New(name, timeout); err != nil {
 			cleanUp(name)
-			log.Debugf("ssh %s error: %s", name, sshPkg.Fatal(name, err))
-			log.Fatalf("can't ssh to %s, make sure \"ssh %s\" works", name, name)
+			log.Fatalf("ssh %s error: %s", name, sshPkg.Fatal(name, err))
 		}
 
 		if created {

cli/updater/updater.go

@@ -441,7 +441,25 @@ func upgrade(cl *dockerclient.Client, stackName, recipeName, upgradeVersion stri
 
 	log.Infof("upgrade %s (%s) to version %s", stackName, recipeName, upgradeVersion)
 
-	err = stack.RunDeploy(cl, deployOpts, compose, stackName, true)
+	serviceNames, err := appPkg.GetAppServiceNames(app.Name)
+	if err != nil {
+		return err
+	}
+
+	f, err := app.Filters(true, false, serviceNames...)
+	if err != nil {
+		return err
+	}
+
+	err = stack.RunDeploy(
+		cl,
+		deployOpts,
+		compose,
+		stackName,
+		app.Server,
+		true,
+		f,
+	)
 
 	return err
 }

go.mod

@@ -1,69 +1,76 @@
 module coopcloud.tech/abra
 
-go 1.23.0
+go 1.23.5
 
-toolchain go1.23.1
+toolchain go1.24.1
 
 require (
-	coopcloud.tech/tagcmp v0.0.0-20230809071031-eb3e7758d4eb
+	coopcloud.tech/tagcmp v0.0.0-20250427094623-9ea3bbbde8e5
 	git.coopcloud.tech/toolshed/godotenv v1.5.2-0.20250103171850-4d0ca41daa5c
 	github.com/AlecAivazis/survey/v2 v2.3.7
+	github.com/charmbracelet/bubbletea v1.3.6
 	github.com/charmbracelet/lipgloss v1.1.0
-	github.com/charmbracelet/log v0.4.1
+	github.com/charmbracelet/log v0.4.2
 	github.com/distribution/reference v0.6.0
-	github.com/docker/cli v28.0.1+incompatible
-	github.com/docker/docker v28.0.1+incompatible
+	github.com/docker/cli v28.3.3+incompatible
+	github.com/docker/docker v28.3.3+incompatible
 	github.com/docker/go-units v0.5.0
-	github.com/go-git/go-git/v5 v5.14.0
+	github.com/go-git/go-git/v5 v5.16.2
 	github.com/google/go-cmp v0.7.0
+	github.com/leonelquinteros/gotext v1.7.2
 	github.com/moby/sys/signal v0.7.1
 	github.com/moby/term v0.5.2
 	github.com/pkg/errors v0.9.1
 	github.com/schollz/progressbar/v3 v3.18.0
-	golang.org/x/term v0.30.0
+	golang.org/x/term v0.34.0
 	gopkg.in/yaml.v3 v3.0.1
 	gotest.tools/v3 v3.5.2
 )
 
 require (
-	dario.cat/mergo v1.0.1 // indirect
-	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
+	dario.cat/mergo v1.0.2 // indirect
+	github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
-	github.com/BurntSushi/toml v1.4.0 // indirect
+	github.com/BurntSushi/toml v1.5.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
-	github.com/ProtonMail/go-crypto v1.1.6 // indirect
+	github.com/ProtonMail/go-crypto v1.3.0 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc // indirect
-	github.com/charmbracelet/x/ansi v0.8.0 // indirect
+	github.com/charmbracelet/colorprofile v0.3.1 // indirect
+	github.com/charmbracelet/x/ansi v0.10.1 // indirect
 	github.com/charmbracelet/x/cellbuf v0.0.13 // indirect
 	github.com/charmbracelet/x/term v0.2.1 // indirect
-	github.com/cloudflare/circl v1.6.0 // indirect
+	github.com/cloudflare/circl v1.6.1 // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.6 // indirect
+	github.com/containerd/platforms v0.2.1 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
 	github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c // indirect
-	github.com/docker/go-connections v0.5.0 // indirect
+	github.com/docker/go-connections v0.6.0 // indirect
 	github.com/docker/go-metrics v0.0.1 // indirect
 	github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
+	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.6.0 // indirect
 	github.com/ghodss/yaml v1.0.0 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-git/go-billy/v5 v5.6.2 // indirect
 	github.com/go-logfmt/logfmt v0.6.0 // indirect
-	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
@@ -73,61 +80,63 @@ require (
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-localereader v0.0.1 // indirect
 	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
 	github.com/miekg/pkcs11 v1.1.1 // indirect
 	github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
-	github.com/mmcloughlin/avo v0.6.0 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/sys/mountinfo v0.6.2 // indirect
-	github.com/moby/sys/user v0.3.0 // indirect
+	github.com/moby/go-archive v0.1.0 // indirect
+	github.com/moby/sys/atomicwriter v0.1.0 // indirect
+	github.com/moby/sys/mountinfo v0.7.2 // indirect
+	github.com/moby/sys/user v0.4.0 // indirect
 	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/morikuni/aec v1.0.0 // indirect
+	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
+	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/muesli/termenv v0.16.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/runc v1.1.13 // indirect
 	github.com/opencontainers/runtime-spec v1.1.0 // indirect
 	github.com/pelletier/go-toml v1.9.5 // indirect
-	github.com/pjbgf/sha1cd v0.3.2 // indirect
+	github.com/pjbgf/sha1cd v0.4.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/common v0.63.0 // indirect
-	github.com/prometheus/procfs v0.15.1 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.65.0 // indirect
+	github.com/prometheus/procfs v0.17.0 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/skeema/knownhosts v1.3.1 // indirect
-	github.com/spf13/pflag v1.0.6 // indirect
+	github.com/spf13/pflag v1.0.7 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
-	go.opentelemetry.io/otel v1.35.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.35.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0 // indirect
+	go.opentelemetry.io/otel v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0 // indirect
-	go.opentelemetry.io/otel/metric v1.35.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.35.0 // indirect
-	go.opentelemetry.io/otel/sdk/metric v1.35.0 // indirect
-	go.opentelemetry.io/otel/trace v1.35.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.5.0 // indirect
-	golang.org/x/crypto v0.36.0 // indirect
-	golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 // indirect
-	golang.org/x/mod v0.24.0 // indirect
-	golang.org/x/net v0.37.0 // indirect
-	golang.org/x/sync v0.12.0 // indirect
-	golang.org/x/text v0.23.0 // indirect
-	golang.org/x/time v0.11.0 // indirect
-	golang.org/x/tools v0.31.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250313205543-e70fdf4c4cb4 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250313205543-e70fdf4c4cb4 // indirect
-	google.golang.org/grpc v1.71.0 // indirect
-	google.golang.org/protobuf v1.36.5 // indirect
+	go.opentelemetry.io/otel/metric v1.37.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.37.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.37.0 // indirect
+	go.opentelemetry.io/otel/trace v1.37.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.7.1 // indirect
+	golang.org/x/crypto v0.41.0 // indirect
+	golang.org/x/exp v0.0.0-20250811191247-51f88131bc50 // indirect
+	golang.org/x/net v0.43.0 // indirect
+	golang.org/x/sync v0.16.0 // indirect
+	golang.org/x/text v0.28.0 // indirect
+	golang.org/x/time v0.12.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250811230008-5f3141c8851a // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a // indirect
+	google.golang.org/grpc v1.74.2 // indirect
+	google.golang.org/protobuf v1.36.7 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 )
@@ -140,15 +149,15 @@ require (
 	github.com/fvbommel/sortorder v1.1.0 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.7
+	github.com/hashicorp/go-retryablehttp v0.7.8
 	github.com/moby/patternmatcher v0.6.0 // indirect
 	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
-	github.com/prometheus/client_golang v1.21.1 // indirect
-	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
+	github.com/prometheus/client_golang v1.23.0 // indirect
+	github.com/sergi/go-diff v1.4.0 // indirect
 	github.com/spf13/cobra v1.9.1
 	github.com/stretchr/testify v1.10.0
 	github.com/theupdateframework/notary v0.7.0 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
-	golang.org/x/sys v0.31.0
+	golang.org/x/sys v0.35.0
 )

go.sum

@@ -24,13 +24,19 @@ cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0Zeo
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
 coopcloud.tech/tagcmp v0.0.0-20230809071031-eb3e7758d4eb h1:Ws6WEwKXeaYEkfdkX6AqX1XLPuaCeyStEtxbmEJPllk=
 coopcloud.tech/tagcmp v0.0.0-20230809071031-eb3e7758d4eb/go.mod h1:ESVm0wQKcbcFi06jItF3rI7enf4Jt2PvbkWpDDHk1DQ=
+coopcloud.tech/tagcmp v0.0.0-20250427094623-9ea3bbbde8e5 h1:tphJCjFJw9fdjyKnbU0f7f3z5KtYE8VbUcAfu+oHKg8=
+coopcloud.tech/tagcmp v0.0.0-20250427094623-9ea3bbbde8e5/go.mod h1:ESVm0wQKcbcFi06jItF3rI7enf4Jt2PvbkWpDDHk1DQ=
 dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
 dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
+dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
+dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
 git.coopcloud.tech/toolshed/godotenv v1.5.2-0.20250103171850-4d0ca41daa5c h1:oeKnUB79PKYD8D0/unYuu7MRcWryQQWOns8+JL+acrs=
 git.coopcloud.tech/toolshed/godotenv v1.5.2-0.20250103171850-4d0ca41daa5c/go.mod h1:fQuhwrpg6qb9NlFXKYi/LysWu1wxjraS8sxyW12CUF0=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=
 github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
 github.com/AlecAivazis/survey/v2 v2.3.7 h1:6I/u8FvytdGsgonrYsVn2t8t4QiRnh6QSTqkkhIiSjQ=
 github.com/AlecAivazis/survey/v2 v2.3.7/go.mod h1:xUTIdE4KCOIjsBAE1JYsUPoCqYdZ1reCfTwbto0Fduo=
 github.com/Azure/azure-sdk-for-go v16.2.1+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
@@ -51,6 +57,8 @@ github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03
 github.com/BurntSushi/toml v1.0.0/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
 github.com/BurntSushi/toml v1.4.0 h1:kuoIxZQy2WRRk1pttg9asf+WVv6tWQuBNVmK8+nqPr0=
 github.com/BurntSushi/toml v1.4.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
+github.com/BurntSushi/toml v1.5.0 h1:W5quZX/G/csjUnuI8SUYlsHs9M38FC7znL0lIO+DvMg=
+github.com/BurntSushi/toml v1.5.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/Microsoft/go-winio v0.4.11/go.mod h1:VhR8bwka0BXejwEJY73c50VrPtXAaKcyvVC4A4RozmA=
 github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=
@@ -79,10 +87,10 @@ github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb0
 github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2 h1:+vx7roKuyA63nhn5WAunQHLTznkw5W8b1Xc0dNjp83s=
 github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2/go.mod h1:HBCaDeC1lPdgDeDbhX8XFpy1jqjK0IBG8W5K+xYqA0w=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
-github.com/ProtonMail/go-crypto v1.1.3 h1:nRBOetoydLeUb4nHajyO2bKqMLfWQ/ZPwkXqXxPxCFk=
-github.com/ProtonMail/go-crypto v1.1.3/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
 github.com/ProtonMail/go-crypto v1.1.6 h1:ZcV+Ropw6Qn0AX9brlQLAUXfqLBc7Bl+f/DmNxpLfdw=
 github.com/ProtonMail/go-crypto v1.1.6/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
+github.com/ProtonMail/go-crypto v1.3.0 h1:ILq8+Sf5If5DCpHQp4PbZdS1J7HDFRXz/+xKBiRGFrw=
+github.com/ProtonMail/go-crypto v1.3.0/go.mod h1:9whxjD8Rbs29b4XWbB8irEcE8KHMqaR2e7GWU1R+/PE=
 github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
 github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
@@ -132,26 +140,32 @@ github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0/go.mod h1:D/8v3k
 github.com/cenkalti/backoff/v4 v4.1.1/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
+github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/charmbracelet/bubbletea v1.3.4 h1:kCg7B+jSCFPLYRA52SDZjr51kG/fMUEoPoZrkaDHyoI=
+github.com/charmbracelet/bubbletea v1.3.4/go.mod h1:dtcUCyCGEX3g9tosuYiut3MXgY/Jsv9nKVdibKKRRXo=
+github.com/charmbracelet/bubbletea v1.3.6 h1:VkHIxPJQeDt0aFJIsVxw8BQdh/F/L2KKZGsK6et5taU=
+github.com/charmbracelet/bubbletea v1.3.6/go.mod h1:oQD9VCRQFF8KplacJLo28/jofOI2ToOfGYeFgBBxHOc=
 github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc h1:4pZI35227imm7yK2bGPcfpFEmuY1gc2YSTShr4iJBfs=
 github.com/charmbracelet/colorprofile v0.2.3-0.20250311203215-f60798e515dc/go.mod h1:X4/0JoqgTIPSFcRA/P6INZzIuyqdFY5rm8tb41s9okk=
-github.com/charmbracelet/lipgloss v1.0.0 h1:O7VkGDvqEdGi93X+DeqsQ7PKHDgtQfF8j8/O2qFMQNg=
-github.com/charmbracelet/lipgloss v1.0.0/go.mod h1:U5fy9Z+C38obMs+T+tJqst9VGzlOYGj4ri9reL3qUlo=
+github.com/charmbracelet/colorprofile v0.3.1 h1:k8dTHMd7fgw4bnFd7jXTLZrSU/CQrKnL3m+AxCzDz40=
+github.com/charmbracelet/colorprofile v0.3.1/go.mod h1:/GkGusxNs8VB/RSOh3fu0TJmQ4ICMMPApIIVn0KszZ0=
 github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=
 github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30=
-github.com/charmbracelet/log v0.4.0 h1:G9bQAcx8rWA2T3pWvx7YtPTPwgqpk7D68BX21IRW8ZM=
-github.com/charmbracelet/log v0.4.0/go.mod h1:63bXt/djrizTec0l11H20t8FDSvA4CRZJ1KH22MdptM=
 github.com/charmbracelet/log v0.4.1 h1:6AYnoHKADkghm/vt4neaNEXkxcXLSV2g1rdyFDOpTyk=
 github.com/charmbracelet/log v0.4.1/go.mod h1:pXgyTsqsVu4N9hGdHmQ0xEA4RsXof402LX9ZgiITn2I=
-github.com/charmbracelet/x/ansi v0.6.0 h1:qOznutrb93gx9oMiGf7caF7bqqubh6YIM0SWKyA08pA=
-github.com/charmbracelet/x/ansi v0.6.0/go.mod h1:KBUFw1la39nl0dLl10l5ORDAqGXaeurTQmwyyVKse/Q=
+github.com/charmbracelet/log v0.4.2 h1:hYt8Qj6a8yLnvR+h7MwsJv/XvmBJXiueUcI3cIxsyig=
+github.com/charmbracelet/log v0.4.2/go.mod h1:qifHGX/tc7eluv2R6pWIpyHDDrrb/AG71Pf2ysQu5nw=
 github.com/charmbracelet/x/ansi v0.8.0 h1:9GTq3xq9caJW8ZrBTe0LIe2fvfLR/bYXKTx2llXn7xE=
 github.com/charmbracelet/x/ansi v0.8.0/go.mod h1:wdYl/ONOLHLIVmQaxbIYEC/cRKOQyjTkowiI4blgS9Q=
+github.com/charmbracelet/x/ansi v0.10.1 h1:rL3Koar5XvX0pHGfovN03f5cxLbCF2YvLeyz7D2jVDQ=
+github.com/charmbracelet/x/ansi v0.10.1/go.mod h1:3RQDQ6lDnROptfpWuUVIUG64bD2g2BgntdxH0Ya5TeE=
 github.com/charmbracelet/x/cellbuf v0.0.13 h1:/KBBKHuVRbq1lYx5BzEHBAFBP8VcQzJejZ/IA3iR28k=
 github.com/charmbracelet/x/cellbuf v0.0.13/go.mod h1:xe0nKWGd3eJgtqZRaN9RjMtK7xUYchjzPr7q6kcvCCs=
 github.com/charmbracelet/x/exp/golden v0.0.0-20240806155701-69247e0abc2a h1:G99klV19u0QnhiizODirwVksQB91TJKV/UaTnACcG30=
@@ -175,10 +189,10 @@ github.com/cilium/ebpf v0.7.0/go.mod h1:/oI2+1shJiTGAMgl6/RgJr36Eo1jzrRcAWbcXO2u
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cloudflare/cfssl v0.0.0-20180223231731-4e2dcbde5004 h1:lkAMpLVBDaj17e85keuznYcH5rqI438v41pKcBl4ZxQ=
 github.com/cloudflare/cfssl v0.0.0-20180223231731-4e2dcbde5004/go.mod h1:yMWuSON2oQp+43nFtAV/uvKQIFpSPerB57DCt9t8sSA=
-github.com/cloudflare/circl v1.5.0 h1:hxIWksrX6XN5a1L2TI/h53AGPhNHoUBo+TD1ms9+pys=
-github.com/cloudflare/circl v1.5.0/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
 github.com/cloudflare/circl v1.6.0 h1:cr5JKic4HI+LkINy2lg3W2jF8sHCVTBncJr5gIIq7qk=
 github.com/cloudflare/circl v1.6.0/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
+github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0=
+github.com/cloudflare/circl v1.6.1/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
@@ -224,6 +238,10 @@ github.com/containerd/continuity v0.0.0-20200710164510-efbc4488d8fe/go.mod h1:cE
 github.com/containerd/continuity v0.0.0-20201208142359-180525291bb7/go.mod h1:kR3BEg7bDFaEddKm54WSmrol1fKWDU1nKYkgrcgZT7Y=
 github.com/containerd/continuity v0.0.0-20210208174643-50096c924a4e/go.mod h1:EXlVlkqNba9rJe3j7w3Xa924itAMLgZH4UD/Q4PExuQ=
 github.com/containerd/continuity v0.1.0/go.mod h1:ICJu0PwR54nI0yPEnJ6jcS+J7CZAUXrLh8lPo2knzsM=
+github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
+github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
+github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
 github.com/containerd/fifo v0.0.0-20180307165137-3d5202aec260/go.mod h1:ODA38xgv3Kuk8dQz2ZQXpnv/UZZUHUCL7pnLehbXgQI=
 github.com/containerd/fifo v0.0.0-20190226154929-a9fb20d87448/go.mod h1:ODA38xgv3Kuk8dQz2ZQXpnv/UZZUHUCL7pnLehbXgQI=
 github.com/containerd/fifo v0.0.0-20200410184934-f15a3290365b/go.mod h1:jPQ2IAeZRCYxpS/Cm1495vGFww6ecHmMk1YJH2Q5ln0=
@@ -246,6 +264,8 @@ github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3
 github.com/containerd/nri v0.0.0-20201007170849-eb1350a75164/go.mod h1:+2wGSDGFYfE5+So4M5syatU0N0f0LbWpuqyMi4/BE8c=
 github.com/containerd/nri v0.0.0-20210316161719-dbaa18c31c14/go.mod h1:lmxnXF6oMkbqs39FiCt1s0R2HSMhcLel9vNL3m4AaeY=
 github.com/containerd/nri v0.1.0/go.mod h1:lmxnXF6oMkbqs39FiCt1s0R2HSMhcLel9vNL3m4AaeY=
+github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpSBQv6A=
+github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
 github.com/containerd/stargz-snapshotter/estargz v0.4.1/go.mod h1:x7Q9dg9QYb4+ELgxmo4gBUeJB0tl5dqH1Sdz0nJU1QM=
 github.com/containerd/stargz-snapshotter/estargz v0.11.0/go.mod h1:/KsZXsJRllMbTKFfG0miFQWViQKdI9+9aSXs+HN0+ac=
 github.com/containerd/ttrpc v0.0.0-20190828154514-0e0f228740de/go.mod h1:PvCDdDGpgqzQIzDW1TphrGLssLDZp2GuS+X5DkEJB8o=
@@ -292,9 +312,10 @@ github.com/coreos/pkg v0.0.0-20160727233714-3ac0863d7acf/go.mod h1:E3G3o1h8I7cfc
 github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
 github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
-github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/cpuguy83/go-md2man/v2 v2.0.6 h1:XJtiaUW6dEEqVuZiMTn1ldk455QWwEIsMIJlo5vtkx0=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
+github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/creack/pty v1.1.17/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
@@ -302,8 +323,6 @@ github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
 github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
 github.com/cyphar/filepath-securejoin v0.2.2/go.mod h1:FpkQEhXnPnOthhzymB7CGsFk2G9VLXONKD9G7QGMM+4=
 github.com/cyphar/filepath-securejoin v0.2.3/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
-github.com/cyphar/filepath-securejoin v0.3.6 h1:4d9N5ykBnSp5Xn2JkhocYDkOpURL/18CYMpo6xB9uWM=
-github.com/cyphar/filepath-securejoin v0.3.6/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
 github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s=
 github.com/cyphar/filepath-securejoin v0.4.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
 github.com/d2g/dhcp4 v0.0.0-20170904100407-a1d1b6c41b1c/go.mod h1:Ct2BUK8SB0YC1SMSibvLzxjeJLnrYEVLULFNiHY9YfQ=
@@ -324,23 +343,21 @@ github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5Qvfr
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/dnaeon/go-vcr v1.0.1/go.mod h1:aBB1+wY4s93YsC3HHjMBMrwTj2R9FHDzUr9KyGc8n1E=
 github.com/docker/cli v0.0.0-20191017083524-a8ff7f821017/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/cli v27.4.1+incompatible h1:VzPiUlRJ/xh+otB75gva3r05isHMo5wXDfPRi5/b4hI=
-github.com/docker/cli v27.4.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/cli v28.0.1+incompatible h1:g0h5NQNda3/CxIsaZfH4Tyf6vpxFth7PYl3hgCPOKzs=
 github.com/docker/cli v28.0.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v28.3.3+incompatible h1:fp9ZHAr1WWPGdIWBM1b3zLtgCF+83gRdVMTJsUeiyAo=
+github.com/docker/cli v28.3.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v0.0.0-20190905152932-14b96e55d84c/go.mod h1:0+TTO4EOBfRPhZXAeF1Vu+W3hHZ8eLp8PgKVZlcvtFY=
 github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/docker v1.4.2-0.20190924003213-a8608b5b67c7/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/docker v27.4.1+incompatible h1:ZJvcY7gfwHn1JF48PfbyXg7Jyt9ZCWDW+GGXOIxEwp4=
-github.com/docker/docker v27.4.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker v28.0.1+incompatible h1:FCHjSRdXhNRFjlHMTv4jUNlIBbTeRjrWfeFuJp7jpo0=
 github.com/docker/docker v28.0.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v28.3.3+incompatible h1:Dypm25kh4rmk49v1eiVbsAtpAsYURjYkaKubwuBdxEI=
+github.com/docker/docker v28.3.3+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.6.3/go.mod h1:WRaJzqw3CTB9bk10avuGsjVBZsD05qeibJ1/TYlvc0Y=
-github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
-github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
 github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8=
 github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo=
 github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c h1:lzqkGL9b3znc+ZUgi7FlLnqjQhcXxkNM/quxIjBVMD0=
@@ -348,6 +365,8 @@ github.com/docker/go v1.5.1-1.0.20160303222718-d30aec9fd63c/go.mod h1:CADgU4DSXK
 github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
 github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
 github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
+github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
+github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
 github.com/docker/go-events v0.0.0-20170721190031-9461782956ad/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
 github.com/docker/go-metrics v0.0.0-20180209012529-399ea8c73916/go.mod h1:/u0gXw0Gay3ceNrsHubL3BtdOL2fHf93USgMTe0W5dI=
@@ -365,9 +384,8 @@ github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4/go.mod h1:Htrtb
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
 github.com/dvsekhvalnov/jose2go v0.0.0-20170216131308-f21a8cedbbae/go.mod h1:7BvyPhdbLxMXIYTFPLsyJRFMsKmOZnQmzh6Gb+uquuM=
 github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
-github.com/elazarl/goproxy v1.2.3 h1:xwIyKHbaP5yfT6O9KIeYJR5549MXRQkoQMRXGztz8YQ=
-github.com/elazarl/goproxy v1.2.3/go.mod h1:YfEbZtqP4AetfO6d40vWchF3znWX7C7Vd6ZMfdL8z64=
 github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o=
+github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE=
 github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
 github.com/emicklei/go-restful v2.9.5+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
@@ -378,6 +396,8 @@ github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1m
 github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
 github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4=
+github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM=
 github.com/erikstmartin/go-testdb v0.0.0-20160219214506-8d10e4a1bae5/go.mod h1:a2zkGnVExMxdzMo3M0Hi/3sEU+cWnZpSni0O6/Yb/P0=
 github.com/evanphx/json-patch v4.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
@@ -402,16 +422,14 @@ github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=
 github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
-github.com/go-git/go-billy/v5 v5.6.1 h1:u+dcrgaguSSkbjzHwelEjc0Yj300NUevrrPphk/SoRA=
-github.com/go-git/go-billy/v5 v5.6.1/go.mod h1:0AsLr1z2+Uksi4NlElmMblP5rPcDZNRCD8ujZCRR2BE=
 github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UNbRM=
 github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.13.1 h1:DAQ9APonnlvSWpvolXWIuV6Q6zXy2wHbN4cVlNR5Q+M=
-github.com/go-git/go-git/v5 v5.13.1/go.mod h1:qryJB4cSBoq3FRoBRf5A77joojuBcmPJ0qu3XXXVixc=
 github.com/go-git/go-git/v5 v5.14.0 h1:/MD3lCrGjCen5WfEAzKg00MJJffKhC8gzS80ycmCi60=
 github.com/go-git/go-git/v5 v5.14.0/go.mod h1:Z5Xhoia5PcWA3NF8vRLURn9E5FRhSl7dGj9ItW3Wk5k=
+github.com/go-git/go-git/v5 v5.16.2 h1:fT6ZIOjE5iEnkzKyxTHK1W4HGAsPhqEqiSAssSO77hM=
+github.com/go-git/go-git/v5 v5.16.2/go.mod h1:4Ge4alE/5gPs30F2H1esi2gPd69R0C39lolkucHBOp8=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -427,6 +445,8 @@ github.com/go-logr/logr v0.2.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTg
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-openapi/jsonpointer v0.0.0-20160704185906-46af16f9f7b1/go.mod h1:+35s3my2LFTysnkMfxsJBAMHj/DoqoB9knIWoYG/Vk0=
@@ -445,6 +465,8 @@ github.com/go-sql-driver/mysql v1.3.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
 github.com/go-viper/mapstructure/v2 v2.2.1 h1:ZAaOCxANMuZx5RCeg0mBdEZk7DZasvvZIxtHqx8aGss=
 github.com/go-viper/mapstructure/v2 v2.2.1/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
+github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/godbus/dbus v0.0.0-20151105175453-c7fdd8b5cd55/go.mod h1:/YcGZj5zSblfDWMMoOzV4fas9FZnQYTkDnsGvmh2Grw=
 github.com/godbus/dbus v0.0.0-20180201030542-885f9cc04c9c/go.mod h1:/YcGZj5zSblfDWMMoOzV4fas9FZnQYTkDnsGvmh2Grw=
 github.com/godbus/dbus v0.0.0-20190422162347-ade71ed3457e/go.mod h1:bBOAhwG1umN6/6ZUMtDFBMQR8jRg9O75tm9K00oMsK4=
@@ -508,8 +530,6 @@ github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/go-containerregistry v0.5.1/go.mod h1:Ct15B4yir3PLOP5jsy0GNeYVaIZs/MK/Jz5any1wFW0=
@@ -553,10 +573,10 @@ github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t
 github.com/grpc-ecosystem/grpc-gateway v1.9.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0 h1:gmcG1KaJ57LophUzW0Hy8NmPhnMZb4M0+kPpLofRdBo=
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.25.1 h1:VNqngBF40hVlDloBruUehVYC3ArSgIyScOAyMRqBxRg=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.25.1/go.mod h1:RBRO7fro65R6tjKzYgLAFo0t1QEXY1Dp+i/bvpRiqiQ=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 h1:5ZPtiqj0JL5oKWmcsq4VMaAW5ukBEgSGXEN89zeH1Jo=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3/go.mod h1:ndYquD05frm2vACXE1nsccT4oJzjhw2arTS2cpUD1PI=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 h1:X5VWvz21y3gzm9Nw/kaUeku/1+uBhcekkmy4IkffJww=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1/go.mod h1:Zanoh4+gvIgluNqcfMVTJueD4wSS5hT7zTt4Mrutd90=
 github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed h1:5upAirOpQc1Q53c0bnx2ufif5kANL7bfZWcc6VJWJd8=
 github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed/go.mod h1:tMWxXQ9wFIaZeTI9F+hmhFiGpFmhOHzyShyFUhRm0H4=
 github.com/hashicorp/errwrap v0.0.0-20141028054710-7554cd9344ce/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -570,6 +590,8 @@ github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHh
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISHxT2Q8+VepXU=
 github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk=
+github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
+github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
@@ -618,8 +640,6 @@ github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+o
 github.com/klauspost/compress v1.11.3/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
 github.com/klauspost/compress v1.11.13/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
 github.com/klauspost/compress v1.14.2/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
-github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
-github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
 github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
 github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
 github.com/klauspost/pgzip v1.2.5/go.mod h1:Ch1tH69qFZu15pkjo5kYi6mth2Zzwzt50oCQKQE9RUs=
@@ -639,6 +659,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/leonelquinteros/gotext v1.7.2 h1:bDPndU8nt+/kRo1m4l/1OXiiy2v7Z7dfPQ9+YP7G1Mc=
+github.com/leonelquinteros/gotext v1.7.2/go.mod h1:9/haCkm5P7Jay1sxKDGJ5WIg4zkz8oZKw4ekNpALob8=
 github.com/lib/pq v0.0.0-20150723085316-0dad96c0b94f/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/linuxkit/virtsock v0.0.0-20201010232012-f8cee7dfc7a3/go.mod h1:3r6x7q95whyfWQpmGZTu3gk3v2YkMi05HEzl7Tf7YEo=
 github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
@@ -653,15 +675,14 @@ github.com/mailru/easyjson v0.7.0/go.mod h1:KAzv3t3aY1NaHWoQz1+4F1ccyAH66Jk7yos7
 github.com/marstr/guid v1.1.0/go.mod h1:74gB1z2wpxxInTG6yaqA7KrtM0NZ+RbrcqDvYHefzho=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
 github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
-github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
-github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=
+github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
 github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
 github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
 github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
@@ -688,18 +709,22 @@ github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/osext v0.0.0-20151018003038-5e2d6d41470f/go.mod h1:OkQIRizQZAeMln+1tSwduZz7+Af5oFlKirV/MSYes2A=
-github.com/mmcloughlin/avo v0.6.0 h1:QH6FU8SKoTLaVs80GA8TJuLNkUYl4VokHKlPhVDg4YY=
-github.com/mmcloughlin/avo v0.6.0/go.mod h1:8CoAGaCSYXtCPR+8y18Y9aB/kxb8JSS6FRI7mSkvD+8=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
+github.com/moby/go-archive v0.1.0 h1:Kk/5rdW/g+H8NHdJW2gsXyZ7UnzvJNOy6VKJqueWdcQ=
+github.com/moby/go-archive v0.1.0/go.mod h1:G9B+YoujNohJmrIYFBpSd54GTUB4lt9S+xVQvsJyFuo=
 github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
 github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk=
 github.com/moby/patternmatcher v0.6.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
+github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw=
+github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs=
 github.com/moby/sys/mountinfo v0.4.0/go.mod h1:rEr8tzG/lsIZHBtN/JjGG+LMYx9eXgW2JI+6q0qou+A=
 github.com/moby/sys/mountinfo v0.4.1/go.mod h1:rEr8tzG/lsIZHBtN/JjGG+LMYx9eXgW2JI+6q0qou+A=
 github.com/moby/sys/mountinfo v0.5.0/go.mod h1:3bMD3Rg+zkqx8MRYPi7Pyb0Ie97QEBmdxbhnCLlSvSU=
 github.com/moby/sys/mountinfo v0.6.2 h1:BzJjoreD5BMFNmD9Rus6gdd1pLuecOFPt8wC+Vygl78=
 github.com/moby/sys/mountinfo v0.6.2/go.mod h1:IJb6JQeOklcdMU9F5xQ8ZALD+CUr5VlGpwtX+VE0rpI=
+github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=
+github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4=
 github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
 github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
 github.com/moby/sys/signal v0.7.1 h1:PrQxdvxcGijdo6UXXo/lU/TvHUWyPhj7UOpSo8tuvk0=
@@ -707,11 +732,11 @@ github.com/moby/sys/signal v0.7.1/go.mod h1:Se1VGehYokAkrSQwL4tDzHvETwUZlnY7S5Xt
 github.com/moby/sys/symlink v0.1.0/go.mod h1:GGDODQmbFOjFsXvfLVn3+ZRxkch54RkSiGqsZeMYowQ=
 github.com/moby/sys/user v0.3.0 h1:9ni5DlcW5an3SvRSx4MouotOygvzaXbaSrc/wGDFWPo=
 github.com/moby/sys/user v0.3.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
+github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
+github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
 github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
 github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/moby/term v0.0.0-20200312100748-672ec06f55cd/go.mod h1:DdlQx2hp0Ss5/fLikoLlEeIYiATotOjgB//nb973jeo=
-github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
-github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
 github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
 github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -722,8 +747,10 @@ github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjY
 github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/mrunalp/fileutils v0.5.0/go.mod h1:M1WthSahJixYnrXQl/DFQuteStB1weuxD2QJNHXfbSQ=
-github.com/muesli/termenv v0.15.2 h1:GohcuySI0QmI3wN8Ok9PtKGkgkFIk7y6Vpb5PvrY+Wo=
-github.com/muesli/termenv v0.15.2/go.mod h1:Epx+iuz8sNs7mNKhxzH4fWXGNpZwUaJKRS1noLXviQ8=
+github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=
+github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6/go.mod h1:CJlz5H+gyd6CUWT45Oy4q24RdLyn7Md9Vj2/ldJBSIo=
+github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
+github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
 github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=
 github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
 github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
@@ -762,8 +789,6 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.0.0/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
 github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
-github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
-github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
 github.com/opencontainers/runc v0.0.0-20190115041553-12f6a991201f/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
@@ -795,10 +820,10 @@ github.com/pelletier/go-toml v1.8.1/go.mod h1:T2/BmBdy8dvIRq1a/8aqjN41wvWlN4lrap
 github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
 github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
-github.com/pjbgf/sha1cd v0.3.1 h1:Dh2GYdpJnO84lIw0LJwTFXjcNbasP/bklicSznyAaPI=
-github.com/pjbgf/sha1cd v0.3.1/go.mod h1:Y8t7jSB/dEI/lQE04A1HVKteqjj9bX5O4+Cex0TCu8s=
 github.com/pjbgf/sha1cd v0.3.2 h1:a9wb0bp1oC2TGwStyn0Umc/IGKQnEgF0vVaZ8QF8eo4=
 github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A=
+github.com/pjbgf/sha1cd v0.4.0 h1:NXzbL1RvjTUi6kgYZCX3fPwwl27Q1LJndxtUDVfJGRY=
+github.com/pjbgf/sha1cd v0.4.0/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1-0.20171018195549-f15c970de5b7/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -814,10 +839,10 @@ github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDf
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQP1xR9D75/vuwEF3g=
 github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
-github.com/prometheus/client_golang v1.20.5 h1:cxppBPuYhUnsO6yo/aoRol4L7q7UFfdm+bR9r+8l63Y=
-github.com/prometheus/client_golang v1.20.5/go.mod h1:PIEt8X02hGcP8JWbeHyeZ53Y/jReSnHgO035n//V5WE=
 github.com/prometheus/client_golang v1.21.1 h1:DOvXXTqVzvkIewV/CDPFdejpMCGeMcbGCQ8YOmu+Ibk=
 github.com/prometheus/client_golang v1.21.1/go.mod h1:U9NM32ykUErtVBxdvD3zfi+EuFkkaBvMb09mIfe0Zgg=
+github.com/prometheus/client_golang v1.23.0 h1:ust4zpdl9r4trLY/gSjlm07PuiBq2ynaXXlptpfy8Uc=
+github.com/prometheus/client_golang v1.23.0/go.mod h1:i/o0R9ByOnHX0McrTMTyhYvKE4haaf2mW08I+jGAjEE=
 github.com/prometheus/client_model v0.0.0-20171117100541-99fa1f4be8e5/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
@@ -825,16 +850,18 @@ github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:
 github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.6.1 h1:ZKSh/rekM+n3CeS952MLRAdFwIKqeY8b62p8ais2e9E=
 github.com/prometheus/client_model v0.6.1/go.mod h1:OrxVMOVHjw3lKMa8+x6HeMGkHMQyHDk9E3jmP2AmGiY=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
 github.com/prometheus/common v0.0.0-20180110214958-89604d197083/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
 github.com/prometheus/common v0.6.0/go.mod h1:eBmuwkDJBwy6iBfxCBob6t6dR6ENT/y+J+Zk0j9GMYc=
 github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
-github.com/prometheus/common v0.61.0 h1:3gv/GThfX0cV2lpO7gkTUwZru38mxevy90Bj8YFSRQQ=
-github.com/prometheus/common v0.61.0/go.mod h1:zr29OCN/2BsJRaFwG8QOBr41D6kkchKbpeNH7pAjb/s=
 github.com/prometheus/common v0.63.0 h1:YR/EIY1o3mEFP/kZCD7iDMnLPlGyuU2Gb3HIcXnA98k=
 github.com/prometheus/common v0.63.0/go.mod h1:VVFF/fBIoToEnWRVkYoXEkq3R3paCoxG9PXP74SnV18=
+github.com/prometheus/common v0.65.0 h1:QDwzd+G1twt//Kwj/Ww6E9FQq1iVMmODnILtW1t2VzE=
+github.com/prometheus/common v0.65.0/go.mod h1:0gZns+BLRQ3V6NdaerOhMbwwRbNh9hkGINtQAsP5GS8=
 github.com/prometheus/procfs v0.0.0-20180125133057-cb4147076ac7/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
@@ -848,6 +875,8 @@ github.com/prometheus/procfs v0.2.0/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4O
 github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
 github.com/prometheus/procfs v0.15.1 h1:YagwOFzUgYfKKHX6Dr+sHT7km/hxC76UB0learggepc=
 github.com/prometheus/procfs v0.15.1/go.mod h1:fB45yRUv8NstnjriLhBQLuOUt+WW4BsoGhij/e3PBqk=
+github.com/prometheus/procfs v0.17.0 h1:FuLQ+05u4ZI+SS/w9+BWEM2TXiHKsUQ9TADiRH7DuK0=
+github.com/prometheus/procfs v0.17.0/go.mod h1:oPQLaDAMRbA+u8H5Pbfq+dl3VDAvHxMUOVhe0wYB2zw=
 github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
@@ -855,18 +884,14 @@ github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUc
 github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
-github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday v1.6.0 h1:KqfZb0pUVN2lYqZUYRddxF4OR8ZMURnJIG5Y3VRLtww=
-github.com/russross/blackfriday v1.6.0/go.mod h1:ti0ldHuxg49ri4ksnFxlkCfN+hvslNlmVHqNRXXJNAY=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/safchain/ethtool v0.0.0-20190326074333-42ed695e3de8/go.mod h1:Z0q5wiBQGYcxhMZ6gUqHn6pYNLypFAvaL3UvgZLR0U4=
 github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
-github.com/schollz/progressbar/v3 v3.17.1 h1:bI1MTaoQO+v5kzklBjYNRQLoVpe0zbyRZNK6DFkVC5U=
-github.com/schollz/progressbar/v3 v3.17.1/go.mod h1:RzqpnsPQNjUyIgdglUjRLgD7sVnxN1wpmBMV+UiEbL4=
 github.com/schollz/progressbar/v3 v3.18.0 h1:uXdoHABRFmNIjUfte/Ex7WtuyVslrw2wVPQmCN62HpA=
 github.com/schollz/progressbar/v3 v3.18.0/go.mod h1:IsO3lpbaGuzh8zIMzgY3+J8l4C8GjO0Y9S69eFvNsec=
 github.com/sclevine/spec v1.2.0/go.mod h1:W4J29eT/Kzv7/b9IWLB055Z+qvVC9vt0Arko24q7p+U=
@@ -874,6 +899,8 @@ github.com/seccomp/libseccomp-golang v0.9.1/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvW
 github.com/seccomp/libseccomp-golang v0.9.2-0.20210429002308-3879420cc921/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg=
 github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
 github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
+github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
+github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/sirupsen/logrus v1.0.4-0.20170822132746-89742aefa4b2/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
 github.com/sirupsen/logrus v1.0.6/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
@@ -885,8 +912,6 @@ github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic
 github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/skeema/knownhosts v1.3.0 h1:AM+y0rI04VksttfwjkSTNQorvGqmwATnvnAHpSgc0LY=
-github.com/skeema/knownhosts v1.3.0/go.mod h1:sPINvnADmT/qYH1kfv+ePMmOBTH6Tbl7b5LvTDjFK7M=
 github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnBY8=
 github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
@@ -903,8 +928,6 @@ github.com/spf13/cobra v0.0.1/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3
 github.com/spf13/cobra v0.0.2-0.20171109065643-2da4a54c5cee/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
 github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
 github.com/spf13/cobra v1.0.0/go.mod h1:/6GTrnGXV9HjY+aR4k0oJ5tcvakLuG6EuKReYlHNrgE=
-github.com/spf13/cobra v1.8.1 h1:e5/vxKd/rZsfSJMUX1agtjeTDf+qv1/JdBF8gg5k9ZM=
-github.com/spf13/cobra v1.8.1/go.mod h1:wHxEcudfqmLYa8iTfL+OuZPbBZkmvliBWKIezN3kD9Y=
 github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
 github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
 github.com/spf13/jwalterweatherman v0.0.0-20141219030609-3d60171a6431/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
@@ -915,10 +938,11 @@ github.com/spf13/pflag v1.0.0/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnIn
 github.com/spf13/pflag v1.0.1-0.20171106142849-4c012f6dcd95/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.1/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
 github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
+github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spf13/viper v0.0.0-20150530192845-be5ff3e4840c/go.mod h1:A8kyI5cUJhb8N+3pkfONlcEcZbueH6nhAm0Fq7SrnBM=
 github.com/spf13/viper v1.4.0 h1:yXHLWeravcrgGyFSyCgdYpXQ9dR9c/WED3pg1RhxqEU=
 github.com/spf13/viper v1.4.0/go.mod h1:PTJ7Z/lr49W6bUbkmS1V3by4uWynFiR9p7+dSq/yZzE=
@@ -995,49 +1019,49 @@ go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
 go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 h1:yd02MEjBdJkG3uabWP9apV+OuWRIXGDuJEUJbOHmCFU=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0/go.mod h1:umTcuxiv1n/s/S6/c2AT/g2CQ7u5C59sHDNmfSwgz7Q=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 h1:sbiXRNDSWJOTobXh5HyQKjq6wUC5tNybqjIqDpAY4CU=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0/go.mod h1:69uWxva0WgAA/4bu2Yy70SLDBwZXuQ6PbBpbsa5iZrQ=
-go.opentelemetry.io/otel v1.33.0 h1:/FerN9bax5LoK51X/sI0SVYrjSE0/yUL7DpxW4K3FWw=
-go.opentelemetry.io/otel v1.33.0/go.mod h1:SUUkR6csvUQl+yjReHu5uM3EtVV7MBm5FHKRlNx4I8I=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0 h1:Hf9xI/XLML9ElpiHVDNwvqI0hIFlzV8dgIr35kV1kRU=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0/go.mod h1:NfchwuyNoMcZ5MLHwPrODwUF1HWCXWrL31s8gSAdIKY=
 go.opentelemetry.io/otel v1.35.0 h1:xKWKPxrxB6OtMCbmMY021CqC45J+3Onta9MqjhnusiQ=
 go.opentelemetry.io/otel v1.35.0/go.mod h1:UEqy8Zp11hpkUrL73gSlELM0DupHoiq72dR+Zqel/+Y=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.33.0 h1:7F29RDmnlqk6B5d+sUqemt8TBfDqxryYW5gX6L74RFA=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.33.0/go.mod h1:ZiGDq7xwDMKmWDrN1XsXAj0iC7hns+2DhxBFSncNHSE=
+go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ=
+go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.35.0 h1:QcFwRrZLc82r8wODjvyCbP7Ifp3UANaBSmhDSFjnqSc=
 go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.35.0/go.mod h1:CXIWhUomyWBG/oY2/r/kLp6K/cmx9e/7DLpBuuGdLCA=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0 h1:Vh5HayB/0HHfOQA7Ctx69E/Y/DcQSMPpKANYVMQ7fBA=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0/go.mod h1:cpgtDBaqD/6ok/UG0jT15/uKjAY8mRA53diogHBg3UI=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.37.0 h1:zG8GlgXCJQd5BU98C0hZnBbElszTmUgCNCfYneaDL0A=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.37.0/go.mod h1:hOfBCz8kv/wuq73Mx2H2QnWokh/kHZxkh6SNF2bdKtw=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 h1:1fTNlAIJZGWLP5FVu0fikVry1IsiUnXjf7QFvoNN3Xw=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0/go.mod h1:zjPK58DtkqQFn+YUMbx0M2XV3QgKU0gS9LeGohREyK4=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0 h1:5pojmb1U1AogINhN3SurB+zm/nIcusopeBNp42f45QM=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.33.0/go.mod h1:57gTHJSE5S1tqg+EKsLPlTWhpHMsWlVmer+LA926XiA=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 h1:Ahq7pZmv87yiyn3jeFz/LekZmPLLdKejuO3NcK9MssM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0/go.mod h1:MJTqhM0im3mRLw1i8uGHnCvUEeS7VwRyxlLC78PA18M=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0 h1:m639+BofXTvcY1q8CGs4ItwQarYtJPOWmVobfM1HpVI=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0/go.mod h1:LjReUci/F4BUyv+y4dwnq3h/26iNOeC3wAIqgvTIZVo=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 h1:EtFWSnwW9hGObjkIdmlnWSydO+Qs8OwzfzXLUPg4xOc=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0/go.mod h1:QjUEoiGCPkvFZ/MjK6ZZfNOS6mfVEVKYE99dFhuN2LI=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0 h1:IeMeyr1aBvBiPVYihXIaeIZba6b8E1bYp7lbdxK8CQg=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.19.0/go.mod h1:oVdCUtjq9MK9BlS7TtucsQwUcXcymNiEDjgDD2jMtZU=
-go.opentelemetry.io/otel/metric v1.33.0 h1:r+JOocAyeRVXD8lZpjdQjzMadVZp2M4WmQ+5WtEnklQ=
-go.opentelemetry.io/otel/metric v1.33.0/go.mod h1:L9+Fyctbp6HFTddIxClbQkjtubW6O9QS3Ann/M82u6M=
 go.opentelemetry.io/otel/metric v1.35.0 h1:0znxYu2SNyuMSQT4Y9WDWej0VpcsxkuklLa4/siN90M=
 go.opentelemetry.io/otel/metric v1.35.0/go.mod h1:nKVFgxBZ2fReX6IlyW28MgZojkoAkJGaE8CpgeAU3oE=
-go.opentelemetry.io/otel/sdk v1.33.0 h1:iax7M131HuAm9QkZotNHEfstof92xM+N8sr3uHXc2IM=
-go.opentelemetry.io/otel/sdk v1.33.0/go.mod h1:A1Q5oi7/9XaMlIWzPSxLRWOI8nG3FnzHJNbiENQuihM=
+go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE=
+go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E=
 go.opentelemetry.io/otel/sdk v1.35.0 h1:iPctf8iprVySXSKJffSS79eOjl9pvxV9ZqOWT0QejKY=
 go.opentelemetry.io/otel/sdk v1.35.0/go.mod h1:+ga1bZliga3DxJ3CQGg3updiaAJoNECOgJREo9KHGQg=
-go.opentelemetry.io/otel/sdk/metric v1.33.0 h1:Gs5VK9/WUJhNXZgn8MR6ITatvAmKeIuCtNbsP3JkNqU=
-go.opentelemetry.io/otel/sdk/metric v1.33.0/go.mod h1:dL5ykHZmm1B1nVRk9dDjChwDmt81MjVp3gLkQRwKf/Q=
+go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI=
+go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg=
 go.opentelemetry.io/otel/sdk/metric v1.35.0 h1:1RriWBmCKgkeHEhM7a2uMjMUfP7MsOF5JpUCaEqEI9o=
 go.opentelemetry.io/otel/sdk/metric v1.35.0/go.mod h1:is6XYCUMpcKi+ZsOvfluY5YstFnhW0BidkR+gL+qN+w=
-go.opentelemetry.io/otel/trace v1.33.0 h1:cCJuF7LRjUFso9LPnEAHJDB2pqzp+hbO8eu1qqW2d/s=
-go.opentelemetry.io/otel/trace v1.33.0/go.mod h1:uIcdVUZMpTAmz0tI1z04GoVSezK37CbGV4fr1f2nBck=
+go.opentelemetry.io/otel/sdk/metric v1.37.0 h1:90lI228XrB9jCMuSdA0673aubgRobVZFhbjxHHspCPc=
+go.opentelemetry.io/otel/sdk/metric v1.37.0/go.mod h1:cNen4ZWfiD37l5NhS+Keb5RXVWZWpRE+9WyVCpbo5ps=
 go.opentelemetry.io/otel/trace v1.35.0 h1:dPpEfJu1sDIqruz7BHFG3c7528f6ddfSWfFDVt/xgMs=
 go.opentelemetry.io/otel/trace v1.35.0/go.mod h1:WUk7DtFp1Aw2MkvqGdwiXYDZZNvA/1J8o6xRXLrIkyc=
+go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4=
+go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go.opentelemetry.io/proto/otlp v1.4.0 h1:TA9WRvW6zMwP+Ssb6fLoUIuirti1gGbP28GcKG1jgeg=
-go.opentelemetry.io/proto/otlp v1.4.0/go.mod h1:PPBWZIP98o2ElSqI35IHfu7hIhSwvc5N38Jw8pXuGFY=
 go.opentelemetry.io/proto/otlp v1.5.0 h1:xJvq7gMzB31/d406fB8U5CBdyQGw4P399D1aQWU/3i4=
 go.opentelemetry.io/proto/otlp v1.5.0/go.mod h1:keN8WnHxOy8PG0rQZjJJ5A2ebUoafqWp0eVQ4yIXvJ4=
+go.opentelemetry.io/proto/otlp v1.7.1 h1:gTOMpGDb0WTBOP8JaO72iL3auEZhVmAQg4ipjOVAtj4=
+go.opentelemetry.io/proto/otlp v1.7.1/go.mod h1:b2rVh6rfI/s2pHWNlB7ILJcRALpcNDzKhACevjI+ZnE=
 go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
@@ -1062,12 +1086,10 @@ golang.org/x/crypto v0.0.0-20201117144127-c1f2f97bffc9/go.mod h1:jdWPYTVW3xRLrWP
 golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
-golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.32.0 h1:euUpcYgM8WcP71gNpTqQCn6rC2t6ULUPiOzfWaXVVfc=
-golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
 golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
 golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
+golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4=
+golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -1078,12 +1100,10 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20250103183323-7d7fa50e5329 h1:9kj3STMvgqy3YA4VQXBrN7925ICMxD5wzMRcgA30588=
-golang.org/x/exp v0.0.0-20250103183323-7d7fa50e5329/go.mod h1:qj5a5QZpwLU2NLQudwIN5koi3beDhSAlJwa67PuM98c=
-golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8 h1:yqrTHse8TCMW1M1ZCP+VAR/l0kKxwaAIqN/il7x4voA=
-golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8/go.mod h1:tujkw807nyEEAamNbDrEGzRav+ilXA7PCRAd6xsmwiU=
 golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 h1:nDVHiLt8aIbd/VzvPWN6kSOPE7+F/fNFDSXLVYkE/Iw=
 golang.org/x/exp v0.0.0-20250305212735-054e65f0b394/go.mod h1:sIifuuw/Yco/y6yb6+bDNfyeQ/MdPUy/hKEMYQV17cM=
+golang.org/x/exp v0.0.0-20250811191247-51f88131bc50 h1:3yiSh9fhy5/RhCSntf4Sy0Tnx50DmMpQ4MQdKKk4yg4=
+golang.org/x/exp v0.0.0-20250811191247-51f88131bc50/go.mod h1:rT6SFzZ7oxADUDx58pcaKFTcZ+inxAa9fTrYx/uVYwg=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -1106,10 +1126,6 @@ golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.22.0 h1:D4nJWe9zXqHOmWqj4VMOJhvzj7bEZg4wEYa759z1pH4=
-golang.org/x/mod v0.22.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
-golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
-golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1151,12 +1167,10 @@ golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96b
 golang.org/x/net v0.0.0-20210825183410-e898025ed96a/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
-golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
-golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
 golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c=
 golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
+golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE=
+golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1174,10 +1188,10 @@ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
-golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
 golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
+golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1247,6 +1261,7 @@ golang.org/x/sys v0.0.0-20210426230700-d19ff857e887/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210906170528-6f6e22806c34/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211116061358-0a5406a5449c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -1254,24 +1269,19 @@ golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
-golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
-golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
 golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
+golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
-golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.28.0 h1:/Ts8HFuMR2E6IP/jlo7QVLZHggjKQbhu/7H0LJFr3Gg=
-golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
 golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
 golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
+golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
+golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1281,22 +1291,20 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
-golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
 golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
 golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
+golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.8.0 h1:9i3RxcPv3PZnitoVGMPDKZSq1xW1gK1Xy3ArNOGZfEg=
-golang.org/x/time v0.8.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
-golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
-golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/time v0.11.0 h1:/bpjEDfN9tkoN/ryeYHnv5hcMlc8ncjMcM4XBk5NWV0=
 golang.org/x/time v0.11.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
+golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE=
+golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg=
 golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20181011042414-1f849cf54d09/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -1342,12 +1350,6 @@ golang.org/x/tools v0.0.0-20200916195026-c9a70fc28ce3/go.mod h1:z6u4i615ZeAfBE4X
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.28.0 h1:WuB6qZ4RPCQo5aP3WdKZS7i595EdWqWR8vqJTlwTVK8=
-golang.org/x/tools v0.28.0/go.mod h1:dcIOrVd3mfQKTgrDVQHqCPMWy6lnhfhtX3hLXYVLfRw=
-golang.org/x/tools v0.29.0 h1:Xx0h3TtM9rzQpQuR4dKLrdglAmCEN5Oi+P74JdhdzXE=
-golang.org/x/tools v0.29.0/go.mod h1:KMQVMRsVxU6nHCFXrBPhDB8XncLNLM0lIy/F14RP588=
-golang.org/x/tools v0.31.0 h1:0EedkvKDbh+qistFTd0Bcwe/YLh4vHwWEkiI0toFIBU=
-golang.org/x/tools v0.31.0/go.mod h1:naFTU+Cev749tSJRXJlna0T3WxKvb1kWEx15xA4SdmQ=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1396,18 +1398,14 @@ google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfG
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
 google.golang.org/genproto v0.0.0-20200527145253-8367513e4ece/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
 google.golang.org/genproto v0.0.0-20201110150050-8816d57aaa9a/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto/googleapis/api v0.0.0-20250102185135-69823020774d h1:H8tOf8XM88HvKqLTxe755haY6r1fqqzLbEnfrmLXlSA=
-google.golang.org/genproto/googleapis/api v0.0.0-20250102185135-69823020774d/go.mod h1:2v7Z7gP2ZUOGsaFyxATQSRoBnKygqVq2Cwnvom7QiqY=
-google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422 h1:GVIKPyP/kLIyVOgOnTwFOrvQaQUzOzGMCxgFUOEmm24=
-google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422/go.mod h1:b6h1vNKhxaSoEI+5jc3PJUCustfli/mRab7295pY7rw=
 google.golang.org/genproto/googleapis/api v0.0.0-20250313205543-e70fdf4c4cb4 h1:IFnXJq3UPB3oBREOodn1v1aGQeZYQclEmvWRMN0PSsY=
 google.golang.org/genproto/googleapis/api v0.0.0-20250313205543-e70fdf4c4cb4/go.mod h1:c8q6Z6OCqnfVIqUFJkCzKcrj8eCvUrz+K4KRzSTuANg=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d h1:xJJRGY7TJcvIlpSrN3K6LAWgNFUILlO+OMAqtg9aqnw=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250102185135-69823020774d/go.mod h1:3ENsm/5D1mzDyhpzeRi1NR784I0BcofWBoSc5QqqMK4=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422 h1:3UsHvIr4Wc2aW4brOaSCmcxh9ksica6fHEr8P1XhkYw=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250106144421-5f5ef82da422/go.mod h1:3ENsm/5D1mzDyhpzeRi1NR784I0BcofWBoSc5QqqMK4=
+google.golang.org/genproto/googleapis/api v0.0.0-20250811230008-5f3141c8851a h1:DMCgtIAIQGZqJXMVzJF4MV8BlWoJh2ZuFiRdAleyr58=
+google.golang.org/genproto/googleapis/api v0.0.0-20250811230008-5f3141c8851a/go.mod h1:y2yVLIE/CSMCPXaHnSKXxu1spLPnglFLegmgdY23uuE=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250313205543-e70fdf4c4cb4 h1:iK2jbkWL86DXjEx0qiHcRE9dE4/Ahua5k6V8OWFb//c=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250313205543-e70fdf4c4cb4/go.mod h1:LuRYeWDFV6WOn90g357N17oMCaxpgCnbi/44qJvDn2I=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a h1:tPE/Kp+x9dMSwUm/uM0JKK0IfdiJkwAbSMSeZBXXJXc=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a/go.mod h1:gw1tLEfykwDz2ET4a12jcXt4couGAm7IwsVaTy0Sflo=
 google.golang.org/grpc v0.0.0-20160317175043-d3ddb4469d5a/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.0.5/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
@@ -1427,10 +1425,10 @@ google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTp
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
 google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
 google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.69.2 h1:U3S9QEtbXC0bYNvRtcoklF3xGtLViumSYxWykJS+7AU=
-google.golang.org/grpc v1.69.2/go.mod h1:vyjdE6jLBI76dgpDojsFGNaHlxdjXN9ghpnd2o7JGZ4=
 google.golang.org/grpc v1.71.0 h1:kF77BGdPTQ4/JZWMlb9VpJ5pa25aqvVqogsxNHHdeBg=
 google.golang.org/grpc v1.71.0/go.mod h1:H0GRtasmQOh9LkFoCPDu3ZrwUtD1YGE+b2vYBYd/8Ec=
+google.golang.org/grpc v1.74.2 h1:WoosgB65DlWVC9FqI82dGsZhWFNBSLjQ84bjROOpMu4=
+google.golang.org/grpc v1.74.2/go.mod h1:CtQ+BGjaAIXHs/5YS3i473GqwBBa1zGQNevxdeBEXrM=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -1444,12 +1442,10 @@ google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlba
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.36.1 h1:yBPeRvTftaleIgM3PZ/WBIZ7XM/eEYAaEyCwvyjq/gk=
-google.golang.org/protobuf v1.36.1/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
-google.golang.org/protobuf v1.36.2 h1:R8FeyR1/eLmkutZOM5CWghmo5itiG9z0ktFlTVLuTmU=
-google.golang.org/protobuf v1.36.2/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
 google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.7 h1:IgrO7UwFQGJdRNXH/sQux4R1Dj1WAKcLElzeeRaXV2A=
+google.golang.org/protobuf v1.36.7/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
 gopkg.in/airbrake/gobrake.v2 v2.0.9/go.mod h1:/h5ZAUhDkGaJfjzjKLSjv6zCL6O0LLBxU4K+aSYdM/U=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/cenkalti/backoff.v2 v2.2.1 h1:eJ9UAg01/HIHG987TwxvnzK2MgxXq97YY6rYDpY9aII=
@@ -1493,8 +1489,6 @@ gotest.tools v2.2.0+incompatible h1:VsBPFP1AI068pPrMxtb/S8Zkgf9xEmTLJjfM+P5UIEo=
 gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
 gotest.tools/v3 v3.0.2/go.mod h1:3SzNCllyD9/Y+b5r9JIKQ474KzkZyqLqEfYqMsX94Bk=
 gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8=
-gotest.tools/v3 v3.5.1 h1:EENdUnS3pdur5nybKYIh2Vfgc8IUNBjxDPSjtiJcOzU=
-gotest.tools/v3 v3.5.1/go.mod h1:isy3WKz7GK6uNw/sbHzfKBLvlvXwUyV06n6brMxxopU=
 gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
 gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=

locales/default.pot

@@ -0,0 +1,12 @@
+msgid ""
+msgstr ""
+"Plural-Forms: nplurals=2; plural=(n != 1);\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Language: \n"
+"X-Generator: xgotext\n"
+
+#: app.go:11
+msgid "Manage apps"
+msgstr ""

locales/es/LC_MESSAGES/default.po

@@ -0,0 +1,20 @@
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: PACKAGE VERSION\n"
+"Report-Msgid-Bugs-To: \n"
+"POT-Creation-Date: 2025-08-04 14:15+0000\n"
+"PO-Revision-Date: 2025-08-04 14:15+0000\n"
+"Last-Translator: 3wordchant <3wc.coopcloud@doesthisthing.work>\n"
+"Language-Team: Spanish <https://translate.coopcloud.tech/projects/"
+"co-op-cloud/abra/es/>\n"
+"Language: es\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: ENCODING\n"
+"Plural-Forms: nplurals=2; plural=n != 1;\n"
+"X-Generator: Weblate 5.12.2\n"
+
+#: app.go:11
+msgid "Manage apps"
+msgstr "Gestionar aplicaciones"

pkg/config/abra.go

@@ -90,6 +90,7 @@ func (a Abra) GetAbraDir() string {
 
 func (a Abra) GetServersDir() string   { return path.Join(a.GetAbraDir(), "servers") }
 func (a Abra) GetRecipesDir() string   { return path.Join(a.GetAbraDir(), "recipes") }
+func (a Abra) GetLogsDir() string      { return path.Join(a.GetAbraDir(), "logs") }
 func (a Abra) GetVendorDir() string    { return path.Join(a.GetAbraDir(), "vendor") }
 func (a Abra) GetBackupDir() string    { return path.Join(a.GetAbraDir(), "backups") }
 func (a Abra) GetCatalogueDir() string { return path.Join(a.GetAbraDir(), "catalogue") }
@@ -100,6 +101,7 @@ var (
 	ABRA_DIR                  = config.GetAbraDir()
 	SERVERS_DIR               = config.GetServersDir()
 	RECIPES_DIR               = config.GetRecipesDir()
+	LOGS_DIR                  = config.GetLogsDir()
 	VENDOR_DIR                = config.GetVendorDir()
 	BACKUP_DIR                = config.GetBackupDir()
 	CATALOGUE_DIR             = config.GetCatalogueDir()

pkg/git/clone.go

@@ -1,7 +1,10 @@
 package git
 
 import (
+	"context"
+	"fmt"
 	"os"
+	"os/signal"
 	"strings"
 
 	"coopcloud.tech/abra/pkg/log"
@@ -22,46 +25,81 @@ func gitCloneIgnoreErr(err error) bool {
 	return false
 }
 
-// Clone runs a git clone which accounts for different default branches.
+// Clone runs a git clone which accounts for different default branches. This
+// function respects Ctrl+C (SIGINT) calls from the user, cancelling the
+// context and deleting the (typically) half-baked clone of the repository.
+// This avoids broken state for future clone / recipe ops.
 func Clone(dir, url string) error {
-	if _, err := os.Stat(dir); os.IsNotExist(err) {
-		log.Debugf("git clone: %s", dir, url)
+	ctx := context.Background()
+	ctx, cancelCtx := context.WithCancel(ctx)
 
-		_, err := git.PlainClone(dir, false, &git.CloneOptions{
-			URL:           url,
-			Tags:          git.AllTags,
-			ReferenceName: plumbing.ReferenceName("refs/heads/main"),
-			SingleBranch:  true,
-		})
+	sigIntCh := make(chan os.Signal, 1)
+	signal.Notify(sigIntCh, os.Interrupt)
+	defer func() {
+		signal.Stop(sigIntCh)
+		cancelCtx()
+	}()
 
-		if err != nil && gitCloneIgnoreErr(err) {
-			log.Debugf("git clone: %s cloned successfully", dir)
-			return nil
-		}
+	errCh := make(chan error)
 
-		if err != nil {
-			log.Debug("git clone: main branch failed, attempting master branch")
+	go func() {
+		if _, err := os.Stat(dir); os.IsNotExist(err) {
+			log.Debugf("git clone: %s", url)
 
-			_, err := git.PlainClone(dir, false, &git.CloneOptions{
+			_, err := git.PlainCloneContext(ctx, dir, false, &git.CloneOptions{
 				URL:           url,
 				Tags:          git.AllTags,
-				ReferenceName: plumbing.ReferenceName("refs/heads/master"),
+				ReferenceName: plumbing.ReferenceName("refs/heads/main"),
 				SingleBranch:  true,
 			})
 
 			if err != nil && gitCloneIgnoreErr(err) {
 				log.Debugf("git clone: %s cloned successfully", dir)
-				return nil
+				errCh <- nil
+			}
+
+			if err := ctx.Err(); err != nil {
+				errCh <- fmt.Errorf("git clone %s: cancelled due to interrupt", dir)
 			}
 
 			if err != nil {
-				return err
+				log.Debug("git clone: main branch failed, attempting master branch")
+
+				_, err := git.PlainCloneContext(ctx, dir, false, &git.CloneOptions{
+					URL:           url,
+					Tags:          git.AllTags,
+					ReferenceName: plumbing.ReferenceName("refs/heads/master"),
+					SingleBranch:  true,
+				})
+
+				if err != nil && gitCloneIgnoreErr(err) {
+					log.Debugf("git clone: %s cloned successfully", dir)
+					errCh <- nil
+				}
+
+				if err != nil {
+					errCh <- err
+				}
 			}
+
+			log.Debugf("git clone: %s cloned successfully", dir)
+		} else {
+			log.Debugf("git clone: %s already exists", dir)
 		}
 
-		log.Debugf("git clone: %s cloned successfully", dir)
-	} else {
-		log.Debugf("git clone: %s already exists", dir)
+		errCh <- nil
+	}()
+
+	select {
+	case <-sigIntCh:
+		cancelCtx()
+		fmt.Println() // NOTE(d1): newline after ^C
+		if err := os.RemoveAll(dir); err != nil {
+			return fmt.Errorf("unable to clean up git clone of %s: %s", dir, err)
+		}
+		return fmt.Errorf("git clone %s: cancelled due to interrupt", dir)
+	case err := <-errCh:
+		return err
 	}
 
 	return nil

pkg/git/clone_test.go

@@ -0,0 +1,48 @@
+package git
+
+import (
+	"fmt"
+	"os"
+	"path"
+	"syscall"
+	"testing"
+
+	"coopcloud.tech/abra/pkg/config"
+)
+
+func TestClone(t *testing.T) {
+	dir := path.Join(config.RECIPES_DIR, "gitea")
+	os.RemoveAll(dir)
+
+	gitURL := fmt.Sprintf("%s/%s.git", config.REPOS_BASE_URL, "gitea")
+	if err := Clone(dir, gitURL); err != nil {
+		t.Fatalf("unable to git clone gitea: %s", err)
+	}
+
+	if _, err := os.Stat(dir); err != nil && os.IsNotExist(err) {
+		t.Fatal("gitea repo was not cloned successfully")
+	}
+}
+
+func TestCancelGitClone(t *testing.T) {
+	dir := path.Join(config.RECIPES_DIR, "gitea")
+	os.RemoveAll(dir)
+
+	go func() {
+		p, err := os.FindProcess(os.Getpid())
+		if err != nil {
+			t.Fatalf("unable to find current process: %s", err)
+		}
+
+		p.Signal(syscall.SIGINT)
+	}()
+
+	gitURL := fmt.Sprintf("%s/%s.git", config.REPOS_BASE_URL, "gitea")
+	if err := Clone(dir, gitURL); err == nil {
+		t.Fatal("cloning should have been interrupted")
+	}
+
+	if _, err := os.Stat(dir); err != nil && !os.IsNotExist(err) {
+		t.Fatal("recipe repo was not deleted")
+	}
+}

pkg/lang/lang.go

@@ -0,0 +1,30 @@
+package lang
+
+import (
+	"os"
+	"strings"
+)
+
+func GetLocale() string {
+	if loc := os.Getenv("LC_MESSAGES"); loc != "" {
+		return NormalizeLocale(loc)
+	}
+
+	if loc := os.Getenv("LANG"); loc != "" {
+		return NormalizeLocale(loc)
+	}
+
+	return "C.UTF-8"
+}
+
+func NormalizeLocale(loc string) string {
+	if idx := strings.Index(loc, "."); idx != -1 {
+		return loc[:idx]
+	}
+
+	if idx := strings.Index(loc, "@"); idx != -1 {
+		return loc[:idx]
+	}
+
+	return loc
+}

pkg/lint/recipe.go

@@ -15,8 +15,10 @@ import (
 	"github.com/go-git/go-git/v5/plumbing"
 )
 
-var Warn = "warn"
-var Critical = "critical"
+var (
+	Warn     = "warn"
+	Critical = "critical"
+)
 
 type LintFunction func(recipe.Recipe) (bool, error)
 
@@ -182,6 +184,8 @@ var LintRules = map[string][]LintRule{
 func LintForErrors(recipe recipe.Recipe) error {
 	log.Debugf("linting for critical errors in %s configs", recipe.Name)
 
+	var errors string
+
 	for level := range LintRules {
 		if level != "error" {
 			continue
@@ -194,14 +198,18 @@ func LintForErrors(recipe recipe.Recipe) error {
 
 			ok, err := rule.Function(recipe)
 			if err != nil {
-				return err
+				errors += fmt.Sprintf("\nlint %s: %s", rule.Ref, err)
 			}
 			if !ok {
-				return fmt.Errorf("lint error in %s configs: \"%s\" failed lint checks (%s)", recipe.Name, rule.Description, rule.Ref)
+				errors += fmt.Sprintf("\n * %s (%s)", rule.Description, rule.Ref)
 			}
 		}
 	}
 
+	if len(errors) > 0 {
+		return fmt.Errorf("recipe '%s' failed lint checks:\n"+errors[1:], recipe.Name)
+	}
+
 	log.Debugf("linting successful, %s is well configured", recipe.Name)
 
 	return nil

pkg/log/log.go

@@ -2,8 +2,10 @@
 package log
 
 import (
+	"math"
 	"os"
 
+	tea "github.com/charmbracelet/bubbletea"
 	charmLog "github.com/charmbracelet/log"
 )
 
@@ -32,3 +34,13 @@ var SetLevel = Logger.SetLevel
 var DebugLevel = charmLog.DebugLevel
 var SetOutput = charmLog.SetOutput
 var SetReportCaller = charmLog.SetReportCaller
+
+type f func() (tea.Model, error)
+
+func Without(fn f) (tea.Model, error) {
+	l := Logger.GetLevel()
+	Logger.SetLevel(math.MaxInt)
+	m, err := fn()
+	Logger.SetLevel(l)
+	return m, err
+}

pkg/logs/logs.go

@@ -0,0 +1,104 @@
+package logs
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"os/signal"
+	"sync"
+
+	"github.com/docker/docker/api/types"
+	containerTypes "github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/filters"
+	dockerClient "github.com/docker/docker/client"
+)
+
+type TailOpts struct {
+	AppName  string
+	Services []string
+	StdErr   bool
+	Since    string
+	Buffer   *[]string
+	ToBuffer bool
+	Filters  filters.Args
+}
+
+// TailLogs gathers logs for the given app with optional service names to be
+// filtered on. These logs can be printed to os.Stdout or gathered to a buffer.
+func TailLogs(
+	cl *dockerClient.Client,
+	opts TailOpts,
+) error {
+	sigIntCh := make(chan os.Signal, 1)
+	signal.Notify(sigIntCh, os.Interrupt)
+	defer signal.Stop(sigIntCh)
+
+	services, err := cl.ServiceList(
+		context.Background(),
+		types.ServiceListOptions{Filters: opts.Filters},
+	)
+	if err != nil {
+		return err
+	}
+
+	errCh := make(chan error)
+	waitCh := make(chan struct{})
+
+	go func() {
+		var wg sync.WaitGroup
+		for _, service := range services {
+			wg.Add(1)
+			go func(serviceID string) {
+				tail := "50"
+				if opts.ToBuffer {
+					// NOTE(d1): more logs from before deployment when analysing via file
+					tail = "150"
+				}
+
+				logs, err := cl.ServiceLogs(context.Background(), serviceID, containerTypes.LogsOptions{
+					ShowStderr: true,
+					ShowStdout: !opts.StdErr,
+					Since:      opts.Since,
+					Until:      "",
+					Timestamps: true,
+					Follow:     true,
+					Tail:       tail,
+					Details:    false,
+				})
+
+				if err == nil {
+					defer logs.Close()
+					if opts.ToBuffer {
+						buf := bufio.NewScanner(logs)
+						for buf.Scan() {
+							line := fmt.Sprintf("%s: %s", service.Spec.Name, buf.Text())
+							*opts.Buffer = append(*opts.Buffer, line)
+						}
+						logs.Close()
+						return
+					}
+
+					if _, err = io.Copy(os.Stdout, logs); err != nil && err != io.EOF {
+						errCh <- fmt.Errorf("tailLogs: unable to copy buffer: %s", err)
+					}
+				}
+			}(service.ID)
+		}
+
+		wg.Wait()
+		close(waitCh)
+	}()
+
+	select {
+	case <-waitCh:
+		return nil
+	case <-sigIntCh:
+		return nil
+	case err := <-errCh:
+		return err
+	}
+
+	return nil
+}

pkg/secret/secret.go

@@ -33,6 +33,10 @@ type Secret struct {
 	// variable. For Example:
 	//   SECRET_FOO=v1 # length=12
 	Length int
+	// Charset comes from the charset modifier at the secret version environment
+	// variable. For Example:
+	//   SECRET_FOO=v1 # charset=default,special
+	Charset string
 	// RemoteName is the name of the secret on the server. For example:
 	//   name: ${STACK_NAME}_test_pass_two_${SECRET_TEST_PASS_TWO_VERSION}
 	// With the following:
@@ -43,38 +47,38 @@ type Secret struct {
 	RemoteName string
 }
 
-// GeneratePasswords generates passwords.
-func GeneratePasswords(count, length uint) ([]string, error) {
+// GeneratePassword generates passwords.
+func GeneratePassword(length uint, charset string) (string, error) {
 	passwords, err := passgen.GeneratePasswords(
-		count,
+		1,
 		length,
-		passgen.AlphabetDefault,
+		charset,
 	)
 	if err != nil {
-		return nil, err
+		return "", err
 	}
 
 	log.Debugf("generated %s", strings.Join(passwords, ", "))
 
-	return passwords, nil
+	return passwords[0], nil
 }
 
-// GeneratePassphrases generates human readable and rememberable passphrases.
-func GeneratePassphrases(count uint) ([]string, error) {
+// GeneratePassphrase generates human readable and rememberable passphrases.
+func GeneratePassphrase() (string, error) {
 	passphrases, err := passgen.GeneratePassphrases(
-		count,
+		1,
 		passgen.PassphraseWordCountDefault,
 		rune('-'),
 		passgen.PassphraseCasingDefault,
 		passgen.WordListDefault,
 	)
 	if err != nil {
-		return nil, err
+		return "", err
 	}
 
 	log.Debugf("generated %s", strings.Join(passphrases, ", "))
 
-	return passphrases, nil
+	return passphrases[0], nil
 }
 
 // ReadSecretsConfig reads secret names/versions from the recipe config. The
@@ -150,6 +154,8 @@ func ReadSecretsConfig(appEnvPath string, composeFiles []string, stackName strin
 				}
 				value.Length = length
 			}
+
+			value.Charset = resolveCharset(modifierValues["charset"])
 			break
 		}
 		secretValues[secretId] = value
@@ -158,6 +164,22 @@ func ReadSecretsConfig(appEnvPath string, composeFiles []string, stackName strin
 	return secretValues, nil
 }
 
+// resolveCharset sets the passgen Alphabet required for a secret
+func resolveCharset(input string) string {
+	switch strings.ToLower(input) {
+	case "special":
+		return passgen.AlphabetSpecial
+	case "safespecial":
+		return "!@#%^&*_-+="
+	case "default,special", "special,default":
+		return passgen.AlphabetDefault + passgen.AlphabetSpecial
+	case "default,safespecial", "safespecial,default":
+		return passgen.AlphabetDefault + "!@#%^&*_-+="
+	default:
+		return passgen.AlphabetDefault // Fallback to default
+	}
+}
+
 // GenerateSecrets generates secrets locally and sends them to a remote server for storage.
 func GenerateSecrets(cl *dockerClient.Client, secrets map[string]Secret, server string) (map[string]string, error) {
 	secretsGenerated := map[string]string{}
@@ -173,13 +195,13 @@ func GenerateSecrets(cl *dockerClient.Client, secrets map[string]Secret, server
 			log.Debugf("attempting to generate and store %s on %s", secret.RemoteName, server)
 
 			if secret.Length > 0 {
-				passwords, err := GeneratePasswords(1, uint(secret.Length))
+				password, err := GeneratePassword(uint(secret.Length), secret.Charset)
 				if err != nil {
 					ch <- err
 					return
 				}
 
-				if err := client.StoreSecret(cl, secret.RemoteName, passwords[0], server); err != nil {
+				if err := client.StoreSecret(cl, secret.RemoteName, password, server); err != nil {
 					if strings.Contains(err.Error(), "AlreadyExists") {
 						log.Warnf("%s already exists", secret.RemoteName)
 						ch <- nil
@@ -191,15 +213,15 @@ func GenerateSecrets(cl *dockerClient.Client, secrets map[string]Secret, server
 
 				mutex.Lock()
 				defer mutex.Unlock()
-				secretsGenerated[secretName] = passwords[0]
+				secretsGenerated[secretName] = password
 			} else {
-				passphrases, err := GeneratePassphrases(1)
+				passphrase, err := GeneratePassphrase()
 				if err != nil {
 					ch <- err
 					return
 				}
 
-				if err := client.StoreSecret(cl, secret.RemoteName, passphrases[0], server); err != nil {
+				if err := client.StoreSecret(cl, secret.RemoteName, passphrase, server); err != nil {
 					if strings.Contains(err.Error(), "AlreadyExists") {
 						log.Warnf("%s already exists", secret.RemoteName)
 						ch <- nil
@@ -211,7 +233,7 @@ func GenerateSecrets(cl *dockerClient.Client, secrets map[string]Secret, server
 
 				mutex.Lock()
 				defer mutex.Unlock()
-				secretsGenerated[secretName] = passphrases[0]
+				secretsGenerated[secretName] = passphrase
 			}
 			ch <- nil
 		}(n, v)

pkg/secret/secret_test.go

@@ -17,16 +17,37 @@ func TestReadSecretsConfig(t *testing.T) {
 	assert.Equal(t, "test_example_com_test_pass_one_v2", secretsFromConfig["test_pass_one"].RemoteName)
 	assert.Equal(t, "v2", secretsFromConfig["test_pass_one"].Version)
 	assert.Equal(t, 0, secretsFromConfig["test_pass_one"].Length)
+	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789", secretsFromConfig["test_pass_one"].Charset)
 
 	// Has a length modifier
 	assert.Equal(t, "test_example_com_test_pass_two_v1", secretsFromConfig["test_pass_two"].RemoteName)
 	assert.Equal(t, "v1", secretsFromConfig["test_pass_two"].Version)
 	assert.Equal(t, 10, secretsFromConfig["test_pass_two"].Length)
+	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789", secretsFromConfig["test_pass_two"].Charset)
 
 	// Secret name does not include the secret id
 	assert.Equal(t, "test_example_com_pass_three_v2", secretsFromConfig["test_pass_three"].RemoteName)
 	assert.Equal(t, "v2", secretsFromConfig["test_pass_three"].Version)
 	assert.Equal(t, 0, secretsFromConfig["test_pass_three"].Length)
+	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789", secretsFromConfig["test_pass_three"].Charset)
+
+	// Has a length modifier and a charset=default,safespecial modifier
+	assert.Equal(t, "test_example_com_test_pass_four_v1", secretsFromConfig["test_pass_four"].RemoteName)
+	assert.Equal(t, "v1", secretsFromConfig["test_pass_four"].Version)
+	assert.Equal(t, 12, secretsFromConfig["test_pass_four"].Length)
+	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789!@#%^&*_-+=", secretsFromConfig["test_pass_four"].Charset)
+
+	// Has a length modifier and a charset=default,special modifier
+	assert.Equal(t, "test_example_com_test_pass_five_v1", secretsFromConfig["test_pass_five"].RemoteName)
+	assert.Equal(t, "v1", secretsFromConfig["test_pass_five"].Version)
+	assert.Equal(t, 12, secretsFromConfig["test_pass_five"].Length)
+	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789!@#$%^&*_-+=", secretsFromConfig["test_pass_five"].Charset)
+
+	// Has only a charset=default,special modifier, which gets setted but ignored in the generation
+	assert.Equal(t, "test_example_com_test_pass_six_v1", secretsFromConfig["test_pass_six"].RemoteName)
+	assert.Equal(t, "v1", secretsFromConfig["test_pass_six"].Version)
+	assert.Equal(t, 0, secretsFromConfig["test_pass_six"].Length)
+	assert.Equal(t, "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789!@#$%^&*_-+=", secretsFromConfig["test_pass_six"].Charset)
 }
 
 func TestReadSecretsConfigWithLongDomain(t *testing.T) {

pkg/secret/testdir/.env.sample

@@ -1,3 +1,6 @@
 SECRET_TEST_PASS_ONE_VERSION=v2
 SECRET_TEST_PASS_TWO_VERSION=v1 # length=10
 SECRET_TEST_PASS_THREE_VERSION=v2
+SECRET_TEST_PASS_FOUR_VERSION=v1 # length=12 charset=default,safespecial
+SECRET_TEST_PASS_FIVE_VERSION=v1 # length=12 charset=default,special
+SECRET_TEST_PASS_SIX_VERSION=v1 # charset=default,special

pkg/secret/testdir/compose.yaml

@@ -8,6 +8,9 @@ services:
       - test_pass_one
       - test_pass_two
       - test_pass_three
+      - test_pass_four
+      - test_pass_five
+      - test_pass_six
 
 secrets:
   test_pass_one:
@@ -19,3 +22,12 @@ secrets:
   test_pass_three:
     external: true
     name: ${STACK_NAME}_pass_three_${SECRET_TEST_PASS_THREE_VERSION} # secretId and name don't match
+  test_pass_four:
+    external: true
+    name: ${STACK_NAME}_test_pass_four_${SECRET_TEST_PASS_FOUR_VERSION}
+  test_pass_five:
+    external: true
+    name: ${STACK_NAME}_test_pass_five_${SECRET_TEST_PASS_FIVE_VERSION}
+  test_pass_six:
+    external: true
+    name: ${STACK_NAME}_test_pass_six_${SECRET_TEST_PASS_SIX_VERSION}

pkg/ssh/ssh.go

@@ -20,6 +20,8 @@ func Fatal(hostname string, err error) error {
 		return fmt.Errorf("ssh auth: permission denied for %s", hostname)
 	} else if strings.Contains(out, "Network is unreachable") {
 		return fmt.Errorf("unable to connect to %s, please check your SSH config", hostname)
+	} else if strings.Contains(out, "Is the docker daemon running") {
+		return fmt.Errorf("docker: is the daemon running / your user has docker permissions?")
 	}
 
 	return err

pkg/ui/deploy.go

@@ -0,0 +1,353 @@
+package ui
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"sort"
+	"strings"
+	"time"
+
+	"coopcloud.tech/abra/pkg/formatter"
+	"coopcloud.tech/abra/pkg/logs"
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/docker/cli/cli/command/service/progress"
+	containerTypes "github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/filters"
+	dockerClient "github.com/docker/docker/client"
+	"github.com/docker/docker/pkg/jsonmessage"
+)
+
+var IsRunning bool
+
+type statusMsg struct {
+	stream  stream
+	jsonMsg jsonmessage.JSONMessage
+}
+
+type progressCompleteMsg struct {
+	stream stream
+	failed bool
+}
+
+type healthcheckMsg struct {
+	stream stream
+	health string
+}
+
+type ServiceMeta struct {
+	Name string
+	ID   string
+}
+
+type Model struct {
+	appName string
+	cl      *dockerClient.Client
+	count   int
+	ctx     context.Context
+	timeout time.Duration
+	width   int
+	filters filters.Args
+
+	Streams  *[]stream
+	Logs     *[]string
+	Failed   bool
+	TimedOut bool
+	Quit     bool
+}
+
+func (m Model) complete() bool {
+	if m.count == len(*m.Streams) {
+		return true
+	}
+	return false
+}
+
+type stream struct {
+	Name string
+	Err  error
+
+	decoder  *json.Decoder
+	id       string
+	reader   *io.PipeReader
+	writer   *io.PipeWriter
+	status   string
+	retries  int
+	health   string
+	rollback bool
+}
+
+func (s stream) String() string {
+	out := fmt.Sprintf("{decoder: %v, ", s.decoder)
+	out += fmt.Sprintf("err: %v, ", s.Err)
+	out += fmt.Sprintf("id: %s, ", s.id)
+	out += fmt.Sprintf("name: %s, ", s.Name)
+	out += fmt.Sprintf("reader: %v, ", s.reader)
+	out += fmt.Sprintf("writer: %v, ", s.writer)
+	out += fmt.Sprintf("status: %s, ", s.status)
+	return out
+}
+
+func (s stream) progress(m Model) tea.Msg {
+	if err := progress.ServiceProgress(m.ctx, m.cl, s.id, s.writer); err != nil {
+		return progressCompleteMsg{
+			stream: s,
+			failed: true,
+		}
+	}
+
+	return progressCompleteMsg{stream: s}
+}
+
+func (s stream) process() tea.Msg {
+	var jsonMsg jsonmessage.JSONMessage
+
+	if err := s.decoder.Decode(&jsonMsg); err != nil {
+		if err == io.EOF {
+			// NOTE(d1): end processing messages
+			return nil
+		}
+	}
+
+	return statusMsg{
+		stream:  s,
+		jsonMsg: jsonMsg,
+	}
+}
+
+func (s stream) healthcheck(m Model) tea.Msg {
+	filters := filters.NewArgs()
+	filters.Add("name", fmt.Sprintf("^%s", s.Name))
+
+	containers, err := m.cl.ContainerList(m.ctx, containerTypes.ListOptions{Filters: filters})
+	if err != nil {
+		s.Err = err
+		return healthcheckMsg{stream: s}
+	}
+
+	if len(containers) == 0 {
+		return healthcheckMsg{stream: s}
+	}
+
+	container := containers[0]
+	containerState, err := m.cl.ContainerInspect(m.ctx, container.ID)
+	if err != nil {
+		s.Err = err
+		return healthcheckMsg{stream: s}
+	}
+
+	var health string
+	if containerState.State.Health != nil {
+		health = containerState.State.Health.Status
+	}
+
+	return healthcheckMsg{stream: s, health: health}
+}
+
+func DeployInitialModel(
+	ctx context.Context,
+	cl *dockerClient.Client,
+	services []ServiceMeta,
+	appName string,
+	timeout time.Duration,
+	filters filters.Args,
+) Model {
+	var streams []stream
+	for _, service := range services {
+		r, w := io.Pipe()
+		d := json.NewDecoder(r)
+		streams = append(streams, stream{
+			Name:    service.Name,
+			id:      service.ID,
+			reader:  r,
+			writer:  w,
+			decoder: d,
+			retries: -1, // NOTE(d1): skip first attempt
+			health:  "?",
+		})
+	}
+
+	sort.Slice(streams, func(i, j int) bool {
+		return streams[i].Name < streams[j].Name
+	})
+
+	return Model{
+		ctx:     ctx,
+		cl:      cl,
+		appName: appName,
+		timeout: timeout,
+		filters: filters,
+		Streams: &streams,
+		Logs:    &[]string{},
+	}
+}
+
+func (m Model) Init() tea.Cmd {
+	var cmds []tea.Cmd
+
+	for _, stream := range *m.Streams {
+		cmds = append(
+			cmds,
+			[]tea.Cmd{
+				func() tea.Msg { return stream.progress(m) },
+				func() tea.Msg { return stream.process() },
+				func() tea.Msg { return stream.healthcheck(m) },
+			}...,
+		)
+	}
+
+	cmds = append(cmds, func() tea.Msg { return deployTimeout(m) })
+	cmds = append(cmds, func() tea.Msg { return m.gatherLogs() })
+
+	return tea.Batch(cmds...)
+}
+
+func (m Model) gatherLogs() tea.Msg {
+	var services []string
+	for _, s := range *m.Streams {
+		services = append(services, s.Name)
+	}
+
+	opts := logs.TailOpts{
+		AppName:  m.appName,
+		Services: services,
+		StdErr:   true,
+		Buffer:   m.Logs,
+		ToBuffer: true,
+		Filters:  m.filters,
+	}
+
+	// NOTE(d1): not interested in log polling errors. if we don't see logs it
+	// will hopefully be self-evident based on what happened in the deployment
+	logs.TailLogs(m.cl, opts)
+
+	return nil
+}
+
+type timeoutMsg struct{}
+
+func deployTimeout(m Model) tea.Msg {
+	<-time.After(m.timeout)
+	return timeoutMsg{}
+}
+
+func (m Model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
+	var cmds []tea.Cmd
+
+	switch msg := msg.(type) {
+	case tea.KeyMsg:
+		switch msg.String() {
+		case "ctrl+c", "q":
+			m.Quit = true
+			return m, tea.Quit
+		}
+
+	case tea.WindowSizeMsg:
+		m.width = msg.Width
+
+	case progressCompleteMsg:
+		if msg.failed {
+			m.Failed = true
+		}
+
+		m.count += 1
+
+		if m.complete() {
+			return m, tea.Quit
+		}
+
+	case timeoutMsg:
+		m.TimedOut = true
+		return m, tea.Quit
+
+	case healthcheckMsg:
+		for idx, s := range *m.Streams {
+			if s.id == msg.stream.id {
+				h := "?"
+				if s.health != "" {
+					h = s.health
+				}
+				if msg.health != "" {
+					h = msg.health
+				}
+				(*m.Streams)[idx].health = h
+			}
+		}
+
+		cmds = append(
+			cmds,
+			func() tea.Msg { return msg.stream.healthcheck(m) },
+		)
+
+	case statusMsg:
+		for idx, s := range *m.Streams {
+			if s.id == msg.stream.id {
+
+				if msg.jsonMsg.ID == "rollback" {
+					m.Failed = true
+					(*m.Streams)[idx].rollback = true
+				}
+
+				if msg.jsonMsg.ID != "overall progress" {
+					newStatus := strings.ToLower(msg.jsonMsg.Status)
+					currentStatus := (*m.Streams)[idx].status
+
+					if !strings.Contains(currentStatus, "starting") &&
+						strings.Contains(newStatus, "starting") {
+						(*m.Streams)[idx].retries += 1
+					}
+
+					if (*m.Streams)[idx].rollback {
+						if msg.jsonMsg.ID == "rollback" {
+							(*m.Streams)[idx].status = newStatus
+						}
+					} else {
+						(*m.Streams)[idx].status = newStatus
+					}
+				}
+			}
+		}
+
+		cmds = append(
+			cmds,
+			func() tea.Msg { return msg.stream.process() },
+		)
+	}
+
+	return m, tea.Batch(cmds...)
+}
+
+func (m Model) View() string {
+	body := strings.Builder{}
+
+	for _, stream := range *m.Streams {
+		split := strings.Split(stream.Name, "_")
+		short := split[len(split)-1]
+
+		status := stream.status
+		if strings.Contains(stream.status, "converged") && !stream.rollback {
+			status = "succeeded"
+		}
+		if strings.Contains(stream.status, "rolled back") {
+			status = "rolled back"
+		}
+
+		retries := 0
+		if stream.retries > 0 {
+			retries = stream.retries
+		}
+
+		output := fmt.Sprintf("%s: %s (retries: %v, healthcheck: %s)",
+			formatter.BoldStyle.Render(short),
+			status,
+			retries,
+			stream.health,
+		)
+
+		body.WriteString(output)
+		body.WriteString("\n")
+	}
+
+	return body.String()
+}

pkg/upstream/stack/remove.go

@@ -3,8 +3,11 @@ package stack // https://github.com/docker/cli/blob/master/cli/command/stack/rem
 import (
 	"context"
 	"fmt"
+	"os"
+	"os/signal"
 	"sort"
 	"strings"
+	"time"
 
 	"coopcloud.tech/abra/pkg/log"
 	"github.com/docker/docker/api/types"
@@ -18,57 +21,87 @@ import (
 
 // RunRemove is the swarm implementation of docker stack remove
 func RunRemove(ctx context.Context, client *apiclient.Client, opts Remove) error {
-	var errs []string
-	for _, namespace := range opts.Namespaces {
-		services, err := GetStackServices(ctx, client, namespace)
-		if err != nil {
-			return err
-		}
+	sigIntCh := make(chan os.Signal, 1)
+	signal.Notify(sigIntCh, os.Interrupt)
+	defer signal.Stop(sigIntCh)
 
-		networks, err := getStackNetworks(ctx, client, namespace)
-		if err != nil {
-			return err
-		}
+	waitCh := make(chan struct{})
+	errCh := make(chan error)
 
-		var secrets []swarm.Secret
-		if versions.GreaterThanOrEqualTo(client.ClientVersion(), "1.25") {
-			secrets, err = getStackSecrets(ctx, client, namespace)
+	go func() {
+		var errs []string
+		for _, namespace := range opts.Namespaces {
+			services, err := GetStackServices(ctx, client, namespace)
 			if err != nil {
-				return err
+				errCh <- err
+				return
+			}
+
+			networks, err := getStackNetworks(ctx, client, namespace)
+			if err != nil {
+				errCh <- err
+				return
+			}
+
+			var secrets []swarm.Secret
+			if versions.GreaterThanOrEqualTo(client.ClientVersion(), "1.25") {
+				secrets, err = getStackSecrets(ctx, client, namespace)
+				if err != nil {
+					errCh <- err
+					return
+				}
+			}
+
+			var configs []swarm.Config
+			if versions.GreaterThanOrEqualTo(client.ClientVersion(), "1.30") {
+				configs, err = getStackConfigs(ctx, client, namespace)
+				if err != nil {
+					errCh <- err
+					return
+				}
+			}
+
+			if len(services)+len(networks)+len(secrets)+len(configs) == 0 {
+				log.Warnf("nothing found in stack: %s", namespace)
+				continue
+			}
+
+			hasError := removeServices(ctx, client, services)
+			hasError = removeSecrets(ctx, client, secrets) || hasError
+			hasError = removeConfigs(ctx, client, configs) || hasError
+			hasError = removeNetworks(ctx, client, networks) || hasError
+
+			if hasError {
+				errs = append(errs, fmt.Sprintf("failed to remove some resources from stack: %s", namespace))
+				continue
+			}
+
+			log.Info("polling undeploy status")
+			timeout, err := waitOnTasks(ctx, client, namespace)
+			if timeout {
+				errs = append(errs, err.Error())
+			} else {
+				if err != nil {
+					errs = append(errs, fmt.Sprintf("failed to wait on tasks of stack: %s: %s", namespace, err))
+				}
 			}
 		}
 
-		var configs []swarm.Config
-		if versions.GreaterThanOrEqualTo(client.ClientVersion(), "1.30") {
-			configs, err = getStackConfigs(ctx, client, namespace)
-			if err != nil {
-				return err
-			}
+		if len(errs) > 0 {
+			errCh <- errors.Errorf(strings.Join(errs, "\n"))
+			return
 		}
 
-		if len(services)+len(networks)+len(secrets)+len(configs) == 0 {
-			log.Warnf("nothing found in stack: %s", namespace)
-			continue
-		}
+		close(waitCh)
+	}()
 
-		hasError := removeServices(ctx, client, services)
-		hasError = removeSecrets(ctx, client, secrets) || hasError
-		hasError = removeConfigs(ctx, client, configs) || hasError
-		hasError = removeNetworks(ctx, client, networks) || hasError
-
-		if hasError {
-			errs = append(errs, fmt.Sprintf("failed to remove some resources from stack: %s", namespace))
-			continue
-		}
-
-		err = waitOnTasks(ctx, client, namespace)
-		if err != nil {
-			errs = append(errs, fmt.Sprintf("failed to wait on tasks of stack: %s: %s", namespace, err))
-		}
-	}
-
-	if len(errs) > 0 {
-		return errors.Errorf(strings.Join(errs, "\n"))
+	select {
+	case <-waitCh:
+		return nil
+	case <-sigIntCh:
+		return fmt.Errorf("skipping as requested, undeploy still in progress 🟠")
+	case err := <-errCh:
+		return err
 	}
 
 	return nil
@@ -88,7 +121,7 @@ func removeServices(
 	var hasError bool
 	sort.Slice(services, sortServiceByName(services))
 	for _, service := range services {
-		log.Infof("removing service %s", service.Spec.Name)
+		log.Debugf("removing service %s", service.Spec.Name)
 		if err := client.ServiceRemove(ctx, service.ID); err != nil {
 			hasError = true
 			log.Fatalf("failed to remove service %s: %s", service.ID, err)
@@ -104,7 +137,7 @@ func removeNetworks(
 ) bool {
 	var hasError bool
 	for _, network := range networks {
-		log.Infof("removing network %s", network.Name)
+		log.Debugf("removing network %s", network.Name)
 		if err := client.NetworkRemove(ctx, network.ID); err != nil {
 			hasError = true
 			log.Fatalf("failed to remove network %s: %s", network.ID, err)
@@ -120,7 +153,7 @@ func removeSecrets(
 ) bool {
 	var hasError bool
 	for _, secret := range secrets {
-		log.Infof("removing secret %s", secret.Spec.Name)
+		log.Debugf("removing secret %s", secret.Spec.Name)
 		if err := client.SecretRemove(ctx, secret.ID); err != nil {
 			hasError = true
 			log.Fatalf("Failed to remove secret %s: %s", secret.ID, err)
@@ -136,7 +169,7 @@ func removeConfigs(
 ) bool {
 	var hasError bool
 	for _, config := range configs {
-		log.Infof("removing config %s", config.Spec.Name)
+		log.Debugf("removing config %s", config.Spec.Name)
 		if err := client.ConfigRemove(ctx, config.ID); err != nil {
 			hasError = true
 			log.Fatalf("failed to remove config %s: %s", config.ID, err)
@@ -170,12 +203,23 @@ func terminalState(state swarm.TaskState) bool {
 	return numberedStates[state] > numberedStates[swarm.TaskStateRunning]
 }
 
-func waitOnTasks(ctx context.Context, client apiclient.APIClient, namespace string) error {
+func waitOnTasks(ctx context.Context, client apiclient.APIClient, namespace string) (bool, error) {
+	var timedOut bool
+
+	log.Debugf("waiting on undeploy tasks (timeout=%v secs)", WaitTimeout)
+
+	go func() {
+		t := time.Duration(WaitTimeout) * time.Second
+		<-time.After(t)
+		log.Debug("timed out on undeploy")
+		timedOut = true
+	}()
+
 	terminalStatesReached := 0
 	for {
 		tasks, err := getStackTasks(ctx, client, namespace)
 		if err != nil {
-			return fmt.Errorf("failed to get tasks: %w", err)
+			return false, fmt.Errorf("failed to get tasks: %w", err)
 		}
 
 		for _, task := range tasks {
@@ -188,6 +232,11 @@ func waitOnTasks(ctx context.Context, client apiclient.APIClient, namespace stri
 		if terminalStatesReached == len(tasks) {
 			break
 		}
+
+		if timedOut {
+			return true, fmt.Errorf("deployment timed out 🟠")
+		}
 	}
-	return nil
+
+	return false, nil
 }

pkg/upstream/stack/stack.go

@@ -3,20 +3,21 @@ package stack // https://github.com/docker/cli/blob/master/cli/command/stack/swa
 import (
 	"context"
 	"fmt"
-	"io"
-	"io/ioutil"
 	"os"
-	"os/signal"
+	"path/filepath"
 	"strconv"
 	"strings"
 	"time"
 
 	stdlibErr "errors"
 
+	tea "github.com/charmbracelet/bubbletea"
+
 	"coopcloud.tech/abra/pkg/config"
 	"coopcloud.tech/abra/pkg/log"
+	"coopcloud.tech/abra/pkg/ui"
 	"coopcloud.tech/abra/pkg/upstream/convert"
-	"github.com/docker/cli/cli/command/service/progress"
+	"github.com/docker/cli/cli/command"
 	"github.com/docker/cli/cli/command/stack/formatter"
 	composetypes "github.com/docker/cli/cli/compose/types"
 	"github.com/docker/docker/api/types"
@@ -177,7 +178,7 @@ func IsDeployed(ctx context.Context, cl *dockerClient.Client, stackName string)
 func pruneServices(ctx context.Context, cl *dockerClient.Client, namespace convert.Namespace, services map[string]struct{}) {
 	oldServices, err := GetStackServices(ctx, cl, namespace.Name())
 	if err != nil {
-		log.Infof("failed to list services: %s", err)
+		log.Warnf("failed to list services: %s", err)
 	}
 
 	pruneServices := []swarm.Service{}
@@ -191,7 +192,17 @@ func pruneServices(ctx context.Context, cl *dockerClient.Client, namespace conve
 }
 
 // RunDeploy is the swarm implementation of docker stack deploy
-func RunDeploy(cl *dockerClient.Client, opts Deploy, cfg *composetypes.Config, appName string, dontWait bool) error {
+func RunDeploy(
+	cl *dockerClient.Client,
+	opts Deploy,
+	cfg *composetypes.Config,
+	appName string,
+	serverName string,
+	dontWait bool,
+	filters filters.Args,
+) error {
+	log.Info("initialising deployment")
+
 	if err := validateResolveImageFlag(&opts); err != nil {
 		return err
 	}
@@ -201,7 +212,16 @@ func RunDeploy(cl *dockerClient.Client, opts Deploy, cfg *composetypes.Config, a
 		opts.ResolveImage = ResolveImageNever
 	}
 
-	return deployCompose(context.Background(), cl, opts, cfg, appName, dontWait)
+	return deployCompose(
+		context.Background(),
+		cl,
+		opts,
+		cfg,
+		appName,
+		serverName,
+		dontWait,
+		filters,
+	)
 }
 
 // validateResolveImageFlag validates the opts.resolveImage command line option
@@ -214,7 +234,16 @@ func validateResolveImageFlag(opts *Deploy) error {
 	}
 }
 
-func deployCompose(ctx context.Context, cl *dockerClient.Client, opts Deploy, config *composetypes.Config, appName string, dontWait bool) error {
+func deployCompose(
+	ctx context.Context,
+	cl *dockerClient.Client,
+	opts Deploy,
+	config *composetypes.Config,
+	appName string,
+	serverName string,
+	dontWait bool,
+	filters filters.Args,
+) error {
 	namespace := convert.NewNamespace(opts.Namespace)
 
 	if opts.Prune {
@@ -255,7 +284,14 @@ func deployCompose(ctx context.Context, cl *dockerClient.Client, opts Deploy, co
 		return err
 	}
 
-	serviceIDs, err := deployServices(ctx, cl, services, namespace, opts.SendRegistryAuth, opts.ResolveImage)
+	serviceIDs, err := deployServices(
+		ctx,
+		cl,
+		services,
+		namespace,
+		opts.SendRegistryAuth,
+		opts.ResolveImage,
+	)
 	if err != nil {
 		return err
 	}
@@ -265,13 +301,16 @@ func deployCompose(ctx context.Context, cl *dockerClient.Client, opts Deploy, co
 		return nil
 	}
 
-	log.Infof("waiting for %s to deploy... please hold 🤚", appName)
-
-	if err := waitOnServices(ctx, cl, serviceIDs, appName); err != nil {
-		return err
+	waitOpts := WaitOpts{
+		Services:   serviceIDs,
+		AppName:    appName,
+		ServerName: serverName,
+		Filters:    filters,
 	}
 
-	log.Infof("successfully deployed %s", appName)
+	if err := WaitOnServices(ctx, cl, waitOpts); err != nil {
+		return err
+	}
 
 	return nil
 }
@@ -343,7 +382,7 @@ func createConfigs(ctx context.Context, cl *dockerClient.Client, configs []swarm
 			}
 		case dockerClient.IsErrNotFound(err):
 			// config does not exist, then we create a new one.
-			log.Infof("creating config %s", configSpec.Name)
+			log.Debugf("creating config %s", configSpec.Name)
 			if _, err := cl.ConfigCreate(ctx, configSpec); err != nil {
 				return errors.Wrapf(err, "failed to create config %s", configSpec.Name)
 			}
@@ -374,7 +413,7 @@ func createNetworks(ctx context.Context, cl *dockerClient.Client, namespace conv
 			createOpts.Driver = defaultNetworkDriver
 		}
 
-		log.Infof("creating network %s", name)
+		log.Debugf("creating network %s", name)
 		if _, err := cl.NetworkCreate(ctx, name, createOpts); err != nil {
 			return errors.Wrapf(err, "failed to create network %s", name)
 		}
@@ -388,10 +427,13 @@ func deployServices(
 	services map[string]swarm.ServiceSpec,
 	namespace convert.Namespace,
 	sendAuth bool,
-	resolveImage string) ([]string, error) {
+	resolveImage string,
+) ([]ui.ServiceMeta, error) {
+	var servicesMeta []ui.ServiceMeta
+
 	existingServices, err := GetStackServices(ctx, cl, namespace.Name())
 	if err != nil {
-		return nil, err
+		return servicesMeta, err
 	}
 
 	existingServiceMap := make(map[string]swarm.Service)
@@ -399,8 +441,6 @@ func deployServices(
 		existingServiceMap[service.Spec.Name] = service
 	}
 
-	var serviceIDs []string
-
 	for internalName, serviceSpec := range services {
 		var (
 			name        = namespace.Scope(internalName)
@@ -408,8 +448,23 @@ func deployServices(
 			encodedAuth string
 		)
 
+		// When sendAuth is set, use the docker cli to retrieve the auth token
+		// for the image we are deploying.
+		// This enables using a private registry by running docker login on the
+		// machine, that abra is executed.
+		if sendAuth {
+			dockerCLI, err := command.NewDockerCli()
+			if err != nil {
+				log.Errorf("retrieving docker auth token: failed create docker cli: %s", err)
+			}
+			encodedAuth, err = command.RetrieveAuthTokenFromImage(dockerCLI.ConfigFile(), image)
+			if err != nil {
+				log.Errorf("failed to retrieve registry auth for image %s: %s", image, err)
+			}
+		}
+
 		if service, exists := existingServiceMap[name]; exists {
-			log.Infof("updating %s", name)
+			log.Debugf("updating %s", name)
 
 			updateOpts := types.ServiceUpdateOptions{EncodedRegistryAuth: encodedAuth}
 
@@ -451,9 +506,12 @@ func deployServices(
 				log.Warn(warning)
 			}
 
-			serviceIDs = append(serviceIDs, service.ID)
+			servicesMeta = append(servicesMeta, ui.ServiceMeta{
+				Name: name,
+				ID:   service.ID,
+			})
 		} else {
-			log.Infof("creating %s", name)
+			log.Debugf("creating %s", name)
 
 			createOpts := types.ServiceCreateOptions{EncodedRegistryAuth: encodedAuth}
 
@@ -467,11 +525,14 @@ func deployServices(
 				return nil, errors.Wrapf(err, "failed to create %s", name)
 			}
 
-			serviceIDs = append(serviceIDs, serviceCreateResponse.ID)
+			servicesMeta = append(servicesMeta, ui.ServiceMeta{
+				Name: name,
+				ID:   serviceCreateResponse.ID,
+			})
 		}
 	}
 
-	return serviceIDs, nil
+	return servicesMeta, nil
 }
 
 func getStackNetworks(ctx context.Context, dockerclient client.APIClient, namespace string) ([]networktypes.Inspect, error) {
@@ -486,67 +547,89 @@ func getStackConfigs(ctx context.Context, dockerclient client.APIClient, namespa
 	return dockerclient.ConfigList(ctx, types.ConfigListOptions{Filters: getStackFilter(namespace)})
 }
 
-func waitOnServices(ctx context.Context, cl *dockerClient.Client, serviceIDs []string, appName string) error {
-	var errs []error
+func timestamp() string {
+	ts := time.Now().UTC().Format(time.RFC3339)
+	return strings.Replace(ts, ":", "", -1) // get rid of offensive colons
+}
 
-	for _, serviceID := range serviceIDs {
-		if err := WaitOnService(ctx, cl, serviceID, appName); err != nil {
-			errs = append(errs, fmt.Errorf("%s: %w", serviceID, err))
-		}
+type WaitOpts struct {
+	AppName    string
+	Filters    filters.Args
+	NoLog      bool
+	Quiet      bool
+	ServerName string
+	Services   []ui.ServiceMeta
+}
+
+func WaitOnServices(ctx context.Context, cl *dockerClient.Client, opts WaitOpts) error {
+	timeout := time.Duration(WaitTimeout) * time.Second
+	model := ui.DeployInitialModel(ctx, cl, opts.Services, opts.AppName, timeout, opts.Filters)
+	tui := tea.NewProgram(model)
+
+	if !opts.Quiet {
+		log.Info("polling deployment status")
 	}
 
-	if len(errs) > 0 {
+	m, err := log.Without(
+		func() (tea.Model, error) {
+			return tui.Run()
+		},
+	)
+	if err != nil {
+		return fmt.Errorf("waitOnServices: error running TUI: %s", err)
+	}
+
+	deployModel := m.(ui.Model)
+	if deployModel.TimedOut || deployModel.Failed || deployModel.Quit {
+		var errs []error
+
+		if deployModel.Failed {
+			errs = append(errs, fmt.Errorf("deploy failed 🛑"))
+		} else if deployModel.TimedOut {
+			errs = append(errs, fmt.Errorf("deploy timed out 🟠"))
+		} else {
+			errs = append(errs, fmt.Errorf("deploy in progress 🟠"))
+		}
+
+		for _, s := range *deployModel.Streams {
+			if s.Err != nil {
+				errs = append(errs, fmt.Errorf("%s: %s", s.Name, s.Err))
+			}
+		}
+
+		if len(*deployModel.Logs) > 0 && !opts.NoLog {
+			logsPath := filepath.Join(
+				config.LOGS_DIR,
+				opts.ServerName,
+				fmt.Sprintf("%s_%s", opts.AppName, timestamp()),
+			)
+
+			if err := os.MkdirAll(filepath.Join(config.LOGS_DIR, opts.ServerName), 0o764); err != nil {
+				return fmt.Errorf("waitOnServices: error creating log dir: %s", err)
+			}
+
+			file, err := os.Create(logsPath)
+			if err != nil {
+				return fmt.Errorf("waitOnServices: error opening file: %s", err)
+			}
+			defer file.Close()
+
+			s := strings.Join(*deployModel.Logs, "\n")
+			if _, err := file.WriteString(s); err != nil {
+				return fmt.Errorf("waitOnServices: writeFile: %s", err)
+			}
+
+			errs = append(errs, fmt.Errorf("logs: %s", logsPath))
+		}
+
 		return stdlibErr.Join(errs...)
 	}
 
-	return nil
-}
-
-// https://github.com/docker/cli/blob/master/cli/command/service/helpers.go
-// https://github.com/docker/cli/blob/master/cli/command/service/progress/progress.go
-func WaitOnService(ctx context.Context, cl *dockerClient.Client, serviceID, appName string) error {
-	errChan := make(chan error, 1)
-	pipeReader, pipeWriter := io.Pipe()
-
-	sigintChannel := make(chan os.Signal, 1)
-	signal.Notify(sigintChannel, os.Interrupt)
-	defer signal.Stop(sigintChannel)
-
-	go func() {
-		errChan <- progress.ServiceProgress(ctx, cl, serviceID, pipeWriter)
-	}()
-
-	go io.Copy(ioutil.Discard, pipeReader)
-
-	timeout := time.Duration(WaitTimeout) * time.Second
-
-	select {
-	case err := <-errChan:
-		return err
-	case <-sigintChannel:
-		return fmt.Errorf(`
-Not waiting for %s to deploy. The deployment is ongoing...
-
-If you want to stop the deployment, try:
-
-    abra app undeploy %s`, appName, appName)
-	case <-time.After(timeout):
-		return fmt.Errorf(`
-%s has not converged (%s second timeout reached).
-
-This does not necessarily mean your deployment has failed, it may just be that
-the app is taking longer to deploy based on your server resources or network
-latency.
-
-You can track latest deployment status with:
-
-    abra app ps %s
-
-And inspect the logs with:
-
-    abra app logs %s
-`, appName, timeout, appName, appName)
+	if !opts.Quiet {
+		log.Info("deploy succeeded 🟢")
 	}
+
+	return nil
 }
 
 // Copypasta from https://github.com/docker/cli/blob/master/cli/command/stack/swarm/list.go

scripts/installer/installer

@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
 
-ABRA_VERSION="0.9.0-beta"
+ABRA_VERSION="0.10.1-beta"
 ABRA_RELEASE_URL="https://git.coopcloud.tech/api/v1/repos/toolshed/abra/releases/tags/$ABRA_VERSION"
-RC_VERSION="0.10.0-rc1-beta"
+RC_VERSION="0.10.1-beta"
 RC_VERSION_URL="https://git.coopcloud.tech/api/v1/repos/toolshed/abra/releases/tags/$RC_VERSION"
 
 for arg in "$@"; do

scripts/installer/makefile

@@ -3,5 +3,5 @@ STACK := abra_installer_script
 default: deploy
 
 deploy:
-	@DOCKER_CONTEXT=swarm.autonomic.zone docker stack rm $(STACK) && \
-		DOCKER_CONTEXT=swarm.autonomic.zone docker stack deploy -c compose.yml $(STACK)
+	@DOCKER_CONTEXT=swarm-0.coopcloud.tech docker stack rm $(STACK) && \
+		DOCKER_CONTEXT=swarm-0.coopcloud.tech docker stack deploy -c compose.yml $(STACK)

tests/integration/app_deploy.bats

@@ -75,6 +75,45 @@ teardown(){
   assert_success
 }
 
+# bats test_tags=slow
+@test "bail if recipe lint errors and no --chaos" {
+  # Break the recipe
+  run sed -i '/traefik.enable=.*/d' "$ABRA_DIR/recipes/$TEST_RECIPE/compose.yml"
+  assert_success
+
+  # Commit the breakage (so we can test without --chaos)
+  _set_git_author
+
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" commit -a -m 'Break recipe'
+  assert_success
+
+  # Make a broken release
+  run $ABRA recipe sync --patch "$TEST_RECIPE"
+  run $ABRA recipe release --patch -n "$TEST_RECIPE"
+
+  # Make sure we deploy latest
+  _wipe_env_version
+  
+  run $ABRA app deploy "$TEST_APP_DOMAIN" --no-input
+  assert_failure
+  assert_output --partial 'failed lint checks'
+
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" reset --hard HEAD~1
+  latestRelease=$(_latest_release)
+  run git -C "$ABRA_DIR/recipes/$TEST_RECIPE" tag -d "$latestRelease"
+}
+
+# bats test_tags=slow
+@test "warn on recipe lint errors with --chaos" {
+  # Break the recipe
+  run sed -i '/traefik.enable=.*/d' "$ABRA_DIR/recipes/$TEST_RECIPE/compose.yml"
+  assert_success
+
+  run $ABRA app deploy "$TEST_APP_DOMAIN" --no-input --no-converge-checks --chaos
+  assert_success
+  assert_output --partial 'failed lint checks'
+}
+
 # bats test_tags=slow
 @test "ensure recipe up to date if no --offline" {
   wantHash=$(_get_n_hash 3)
@@ -108,8 +147,6 @@ teardown(){
 
 # bats test_tags=slow
 @test "deploy latest commit if no published versions and no --chaos" {
-  latestCommit="$(git -C "$ABRA_DIR/recipes/$TEST_RECIPE" rev-parse --short HEAD)"
-
   _remove_tags
   _wipe_env_version
 
@@ -117,7 +154,7 @@ teardown(){
   run $ABRA app deploy "$TEST_APP_DOMAIN" \
     --no-input --no-converge-checks --offline
   assert_success
-  assert_output --partial "$latestCommit"
+  assert_output --partial "${_get_head_hash:0:8}"
 }
 
 # bats test_tags=slow
@@ -149,16 +186,6 @@ teardown(){
   assert_exists "$ABRA_DIR/recipes/$TEST_RECIPE"
 }
 
-@test "no deploy if lint error" {
-  run sed -i '/traefik.enable=.*/d' "$ABRA_DIR/recipes/$TEST_RECIPE/compose.yml"
-  assert_success
-
-  run $ABRA app deploy "$TEST_APP_DOMAIN" \
-    --no-input --no-converge-checks --chaos
-  assert_failure
-  assert_output --partial 'failed lint checks'
-}
-
 # bats test_tags=slow
 @test "error if already deployed and no --force/--chaos" {
   _deploy_app
@@ -403,8 +430,6 @@ teardown(){
 
 # bats test_tags=slow
 @test "ignore env version on new deploy" {
-  tagHash=$(_get_tag_hash "0.1.0+1.20.0")
-
   run $ABRA app deploy "$TEST_APP_DOMAIN" "0.1.0+1.20.0" \
     --no-input --no-converge-checks
   assert_success

tests/integration/app_list.bats

@@ -8,6 +8,7 @@ setup_file(){
 }
 
 teardown_file(){
+  _undeploy_app
   _rm_app
   _rm_server
 }
@@ -18,6 +19,7 @@ setup(){
 }
 
 teardown(){
+  _reset_recipe
   _undeploy_app
 }
 
@@ -87,6 +89,10 @@ teardown(){
   assert_success
   refute_output --partial "$TEST_RECIPE"
   assert_output --partial "foo-recipe"
+
+  run rm -rf "$ABRA_DIR/servers/foo.com"
+  assert_success
+  assert_not_exists "$ABRA_DIR/servers/foo.com"
 }
 
 @test "output is machine readable" {
@@ -98,3 +104,36 @@ teardown(){
 
   assert_output --partial "$expectedOutput"
 }
+
+# bats test_tags=slow
+@test "list with status fetches recipe" {
+  _deploy_app
+
+  run $ABRA app ls --status
+  assert_success
+
+  run rm -rf "$ABRA_DIR/recipes/$TEST_RECIPE"
+  assert_success
+
+  run $ABRA app ls --status
+  assert_success
+}
+
+# bats test_tags=slow
+@test "list with chaos version" {
+  run bash -c "echo foo >> $ABRA_DIR/recipes/$TEST_RECIPE/foo"
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
+
+  run $ABRA app deploy "$TEST_APP_DOMAIN" \
+    --no-input --no-converge-checks --chaos
+  assert_success
+
+  run $ABRA app ls --status
+  assert_success
+  assert_output --partial "+U"
+
+  run rm -rf "$ABRA_DIR/servers/foo.com"
+  assert_success
+  assert_not_exists "$ABRA_DIR/servers/foo.com"
+}

tests/integration/app_new.bats

@@ -214,8 +214,7 @@ teardown(){
     --chaos
   assert_success
   assert_exists "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
-  assert_output --partial "version: ${currentHash:0:8}"
-  assert_output --partial "chaos: ${currentHash:0:8}"
+  assert_output --partial "version: ${currentHash:0:8}+U"
 
   assert_exists "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
   assert_equal "$(_git_status)" "?? foo"
@@ -242,8 +241,7 @@ teardown(){
     --chaos
   assert_success
   assert_exists "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
-  assert_output --partial "version: ${currentHash:0:8}"
-  assert_output --partial "chaos: ${currentHash:0:8}"
+  assert_output --partial "version: ${currentHash:0:8}+U"
 
   assert_exists "$ABRA_DIR/recipes/$TEST_RECIPE/foo"
   assert_equal "$(_git_status)" "?? foo"
@@ -252,3 +250,10 @@ teardown(){
     "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
   assert_success
 }
+
+@test "automatically select single server" {
+  # NOTE(d1): no --no-input required, single server available
+  run $ABRA app new "$TEST_RECIPE" --domain "$TEST_APP_DOMAIN"
+  assert_success
+  assert_exists "$ABRA_DIR/servers/$TEST_SERVER/$TEST_APP_DOMAIN.env"
+}

tests/integration/app_upgrade.bats

@@ -204,6 +204,18 @@ teardown(){
   assert_output --partial 'release notes baz' # 0.2.0+1.21.0
 }
 
+# bats test_tags=slow
+@test "show release note added after release" {
+  run $ABRA app deploy "$TEST_APP_DOMAIN" "0.2.0+1.21.0" --no-input --no-converge-checks
+  assert_success
+  assert_output --partial '0.2.0+1.21.0'
+
+  run $ABRA app upgrade "$TEST_APP_DOMAIN" "0.3.0+1.21.0" --no-input --no-converge-checks
+  assert_success
+  assert_output --partial '0.3.0+1.21.0'
+  assert_output --partial 'A release note added after the release'
+}
+
 # bats test_tags=slow
 @test "upgrade commit deployment not possible" {
   tagHash=$(_get_tag_hash "0.1.0+1.20.0")

tests/integration/dirs.bats

@@ -24,7 +24,7 @@ setup(){
   assert_success
 }
 
-@test "abra directory is created" {
+@test "abra directories are created" {
   run $ABRA app ls
 
   # NOTE(d1): no servers yet, so will fail. however, it will run the required
@@ -35,8 +35,9 @@ setup(){
   assert_exists "$ABRA_DIR"
   assert_exists "$ABRA_DIR/servers"
   assert_exists "$ABRA_DIR/recipes"
-  assert_exists "$ABRA_DIR/backups"
-  assert_exists "$ABRA_DIR/vendor"
 
   assert_not_exists "$ABRA_DIR/catalogue"
+
+  server_dir_perms=$(stat -c "%a" "$ABRA_DIR/servers")
+  assert_equal $server_dir_perms "600"
 }

tests/integration/install.bats

@@ -25,13 +25,3 @@ teardown(){
   run "$HOME/.local/bin/abra" -v
   assert_output --partial 'beta'
 }
-
-# bats test_tags=slow
-@test "install release candidate from script" {
-  run bash -c 'curl https://install.abra.coopcloud.tech | bash -s -- --rc'
-  assert_success
-
-  assert_exists "$HOME/.local/bin/abra"
-  run "$HOME/.local/bin/abra" -v
-  assert_output --partial '-rc'
-}

tests/integration/recipe_fetch.bats

@@ -5,6 +5,16 @@ setup() {
   _common_setup
 }
 
+teardown(){
+  run rm -rf "$ABRA_DIR/recipes/matrix-synapse"
+  assert_success
+  assert_not_exists "$ABRA_DIR/recipes/$TEST_RECIPE"
+
+  run rm -rf "$ABRA_DIR/recipes/git_coopcloud_tech_coop-cloud_matrix-synapse"
+  assert_success
+  assert_not_exists "$ABRA_DIR/recipes/git_coopcloud_tech_coop-cloud_matrix-synapse"
+}
+
 # bats test_tags=slow
 @test "recipe fetch all" {
   run rm -rf "$ABRA_DIR/recipes/matrix-synapse"
@@ -35,3 +45,81 @@ setup() {
   run $ABRA recipe fetch matrix-synapse --all
   assert_failure
 }
+
+@test "do not refetch without --force" {
+  run $ABRA recipe fetch matrix-synapse
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/matrix-synapse"
+
+  run $ABRA recipe fetch matrix-synapse
+  assert_output --partial "already fetched"
+}
+
+@test "refetch with --force" {
+  run $ABRA recipe fetch matrix-synapse
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/matrix-synapse"
+
+  run $ABRA recipe fetch matrix-synapse --force
+  assert_success
+  refute_output --partial "already fetched"
+}
+
+@test "refetch with --force does not erase unstaged changes" {
+  run $ABRA recipe fetch matrix-synapse
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/matrix-synapse"
+
+  run bash -c "echo foo >> $ABRA_DIR/recipes/matrix-synapse/foo"
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/matrix-synapse/foo"
+
+  run $ABRA recipe fetch matrix-synapse --force
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/matrix-synapse"
+  assert_exists "$ABRA_DIR/recipes/matrix-synapse/foo"
+}
+
+@test "fetch with --ssh" {
+  run $ABRA recipe fetch matrix-synapse --ssh
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/matrix-synapse"
+
+  run git -C "$ABRA_DIR/recipes/matrix-synapse" remote -v
+  assert_success
+  assert_output --partial "ssh://"
+}
+
+@test "re-fetch with --ssh/--force" {
+  run $ABRA recipe fetch matrix-synapse
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/matrix-synapse"
+
+  run git -C "$ABRA_DIR/recipes/matrix-synapse" remote -v
+  assert_success
+  assert_output --partial "https://"
+
+  run $ABRA recipe fetch matrix-synapse --ssh --force
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/matrix-synapse"
+
+  run git -C "$ABRA_DIR/recipes/matrix-synapse" remote -v
+  assert_success
+  assert_output --partial "ssh://"
+}
+
+@test "fetch remote recipe" {
+  run $ABRA recipe fetch git.coopcloud.tech/coop-cloud/matrix-synapse
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/git_coopcloud_tech_coop-cloud_matrix-synapse"
+}
+
+@test "remote recipe do not refetch without --force" {
+  run $ABRA recipe fetch git.coopcloud.tech/coop-cloud/matrix-synapse
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/git_coopcloud_tech_coop-cloud_matrix-synapse"
+
+  run $ABRA recipe fetch git.coopcloud.tech/coop-cloud/matrix-synapse
+  assert_success
+  assert_output --partial "already fetched"
+}

tests/integration/recipe_new.bats

@@ -68,3 +68,27 @@ teardown(){
   assert_output --partial 'fooUser'
   assert_output --partial 'foo@example.com'
 }
+
+# bats test_tags=slow
+@test "recipe new, app new, no releases, latest commit" {
+  recipeName="foobar"
+
+  run $ABRA recipe new "$recipeName"
+  assert_success
+  assert_exists "$ABRA_DIR/recipes/$recipeName"
+
+  currentHash=$(git -C "$ABRA_DIR/recipes/$recipeName" show -s --format="%H")
+  domain="$recipeName.$TEST_APP_SERVER" 
+
+  run $ABRA app new "$recipeName" \
+    --no-input \
+    --server "$TEST_SERVER" \
+    --domain "$domain"
+  assert_success
+  assert_output --partial "version: ${currentHash:0:8}"
+  assert_exists "$ABRA_DIR/servers/$TEST_SERVER/$domain.env"
+
+  run grep -q "TYPE=$recipeName:${currentHash:0:8}" \
+    "$ABRA_DIR/servers/$TEST_SERVER/$domain.env"
+  assert_success
+}

tests/integration/upgrade.bats

@@ -26,14 +26,3 @@ teardown(){
   run "$HOME/.local/bin/abra" -v
   assert_output --partial 'beta'
 }
-
-# bats test_tags=slow
-@test "abra upgrade release candidate" {
-  run $ABRA upgrade --rc
-  assert_success
-  assert_output --partial 'Public interest infrastructure'
-
-  assert_exists "$HOME/.local/bin/abra"
-  run "$HOME/.local/bin/abra" -v
-  assert_output --partial '-rc'
-}

vendor/coopcloud.tech/tagcmp/renovate.json

@@ -1,3 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json"
-}

vendor/dario.cat/mergo/FUNDING.json

@@ -0,0 +1,7 @@
+{
+  "drips": {
+    "ethereum": {
+      "ownedBy": "0x6160020e7102237aC41bdb156e94401692D76930"
+    }
+  }
+}

vendor/dario.cat/mergo/README.md

@@ -85,7 +85,6 @@ Mergo is used by [thousands](https://deps.dev/go/dario.cat%2Fmergo/v1.0.0/depend
 * [goreleaser/goreleaser](https://github.com/goreleaser/goreleaser)
 * [go-micro/go-micro](https://github.com/go-micro/go-micro)
 * [grafana/loki](https://github.com/grafana/loki)
-* [kubernetes/kubernetes](https://github.com/kubernetes/kubernetes)
 * [masterminds/sprig](github.com/Masterminds/sprig)
 * [moby/moby](https://github.com/moby/moby)
 * [slackhq/nebula](https://github.com/slackhq/nebula)
@@ -191,10 +190,6 @@ func main() {
 }
 ```
 
-Note: if test are failing due missing package, please execute:
-
-    go get gopkg.in/yaml.v3
-
 ### Transformers
 
 Transformers allow to merge specific types differently than in the default behavior. In other words, now you can customize how some types are merged. For example, `time.Time` is a struct; it doesn't have zero value but IsZero can return true because it has fields with zero value. How can we merge a non-zero `time.Time`?

vendor/dario.cat/mergo/SECURITY.md

@@ -4,8 +4,8 @@
 
 | Version | Supported          |
 | ------- | ------------------ |
-| 0.3.x   | :white_check_mark: |
-| < 0.3   | :x:                |
+| 1.x.x   | :white_check_mark: |
+| < 1.0   | :x:                |
 
 ## Security contact information
 

vendor/github.com/BurntSushi/toml/README.md

@@ -3,7 +3,7 @@ reflection interface similar to Go's standard library `json` and `xml` packages.
 
 Compatible with TOML version [v1.0.0](https://toml.io/en/v1.0.0).
 
-Documentation: https://godocs.io/github.com/BurntSushi/toml
+Documentation: https://pkg.go.dev/github.com/BurntSushi/toml
 
 See the [releases page](https://github.com/BurntSushi/toml/releases) for a
 changelog; this information is also in the git tag annotations (e.g. `git show

vendor/github.com/BurntSushi/toml/decode.go

@@ -196,6 +196,19 @@ func (md *MetaData) PrimitiveDecode(primValue Primitive, v any) error {
 	return md.unify(primValue.undecoded, rvalue(v))
 }
 
+// markDecodedRecursive is a helper to mark any key under the given tmap as
+// decoded, recursing as needed
+func markDecodedRecursive(md *MetaData, tmap map[string]any) {
+	for key := range tmap {
+		md.decoded[md.context.add(key).String()] = struct{}{}
+		if tmap, ok := tmap[key].(map[string]any); ok {
+			md.context = append(md.context, key)
+			markDecodedRecursive(md, tmap)
+			md.context = md.context[0 : len(md.context)-1]
+		}
+	}
+}
+
 // unify performs a sort of type unification based on the structure of `rv`,
 // which is the client representation.
 //
@@ -222,6 +235,16 @@ func (md *MetaData) unify(data any, rv reflect.Value) error {
 		if err != nil {
 			return md.parseErr(err)
 		}
+		// Assume the Unmarshaler decoded everything, so mark all keys under
+		// this table as decoded.
+		if tmap, ok := data.(map[string]any); ok {
+			markDecodedRecursive(md, tmap)
+		}
+		if aot, ok := data.([]map[string]any); ok {
+			for _, tmap := range aot {
+				markDecodedRecursive(md, tmap)
+			}
+		}
 		return nil
 	}
 	if v, ok := rvi.(encoding.TextUnmarshaler); ok {
@@ -540,12 +563,14 @@ func (md *MetaData) badtype(dst string, data any) error {
 
 func (md *MetaData) parseErr(err error) error {
 	k := md.context.String()
+	d := string(md.data)
 	return ParseError{
-		LastKey:  k,
-		Position: md.keyInfo[k].pos,
-		Line:     md.keyInfo[k].pos.Line,
+		Message:  err.Error(),
 		err:      err,
-		input:    string(md.data),
+		LastKey:  k,
+		Position: md.keyInfo[k].pos.withCol(d),
+		Line:     md.keyInfo[k].pos.Line,
+		input:    d,
 	}
 }
 

vendor/github.com/BurntSushi/toml/encode.go

@@ -402,31 +402,30 @@ func (enc *Encoder) eMap(key Key, rv reflect.Value, inline bool) {
 
 	// Sort keys so that we have deterministic output. And write keys directly
 	// underneath this key first, before writing sub-structs or sub-maps.
-	var mapKeysDirect, mapKeysSub []string
+	var mapKeysDirect, mapKeysSub []reflect.Value
 	for _, mapKey := range rv.MapKeys() {
-		k := mapKey.String()
 		if typeIsTable(tomlTypeOfGo(eindirect(rv.MapIndex(mapKey)))) {
-			mapKeysSub = append(mapKeysSub, k)
+			mapKeysSub = append(mapKeysSub, mapKey)
 		} else {
-			mapKeysDirect = append(mapKeysDirect, k)
+			mapKeysDirect = append(mapKeysDirect, mapKey)
 		}
 	}
 
-	var writeMapKeys = func(mapKeys []string, trailC bool) {
-		sort.Strings(mapKeys)
+	writeMapKeys := func(mapKeys []reflect.Value, trailC bool) {
+		sort.Slice(mapKeys, func(i, j int) bool { return mapKeys[i].String() < mapKeys[j].String() })
 		for i, mapKey := range mapKeys {
-			val := eindirect(rv.MapIndex(reflect.ValueOf(mapKey)))
+			val := eindirect(rv.MapIndex(mapKey))
 			if isNil(val) {
 				continue
 			}
 
 			if inline {
-				enc.writeKeyValue(Key{mapKey}, val, true)
+				enc.writeKeyValue(Key{mapKey.String()}, val, true)
 				if trailC || i != len(mapKeys)-1 {
 					enc.wf(", ")
 				}
 			} else {
-				enc.encode(key.add(mapKey), val)
+				enc.encode(key.add(mapKey.String()), val)
 			}
 		}
 	}
@@ -441,8 +440,6 @@ func (enc *Encoder) eMap(key Key, rv reflect.Value, inline bool) {
 	}
 }
 
-const is32Bit = (32 << (^uint(0) >> 63)) == 32
-
 func pointerTo(t reflect.Type) reflect.Type {
 	if t.Kind() == reflect.Ptr {
 		return pointerTo(t.Elem())
@@ -477,15 +474,14 @@ func (enc *Encoder) eStruct(key Key, rv reflect.Value, inline bool) {
 
 			frv := eindirect(rv.Field(i))
 
-			if is32Bit {
-				// Copy so it works correct on 32bit archs; not clear why this
-				// is needed. See #314, and https://www.reddit.com/r/golang/comments/pnx8v4
-				// This also works fine on 64bit, but 32bit archs are somewhat
-				// rare and this is a wee bit faster.
-				copyStart := make([]int, len(start))
-				copy(copyStart, start)
-				start = copyStart
-			}
+			// Need to make a copy because ... ehm, I don't know why... I guess
+			// allocating a new array can cause it to fail(?)
+			//
+			// Done for: https://github.com/BurntSushi/toml/issues/430
+			// Previously only on 32bit for: https://github.com/BurntSushi/toml/issues/314
+			copyStart := make([]int, len(start))
+			copy(copyStart, start)
+			start = copyStart
 
 			// Treat anonymous struct fields with tag names as though they are
 			// not anonymous, like encoding/json does.
@@ -507,7 +503,7 @@ func (enc *Encoder) eStruct(key Key, rv reflect.Value, inline bool) {
 	}
 	addFields(rt, rv, nil)
 
-	writeFields := func(fields [][]int) {
+	writeFields := func(fields [][]int, totalFields int) {
 		for _, fieldIndex := range fields {
 			fieldType := rt.FieldByIndex(fieldIndex)
 			fieldVal := rv.FieldByIndex(fieldIndex)
@@ -537,7 +533,7 @@ func (enc *Encoder) eStruct(key Key, rv reflect.Value, inline bool) {
 
 			if inline {
 				enc.writeKeyValue(Key{keyName}, fieldVal, true)
-				if fieldIndex[0] != len(fields)-1 {
+				if fieldIndex[0] != totalFields-1 {
 					enc.wf(", ")
 				}
 			} else {
@@ -549,8 +545,10 @@ func (enc *Encoder) eStruct(key Key, rv reflect.Value, inline bool) {
 	if inline {
 		enc.wf("{")
 	}
-	writeFields(fieldsDirect)
-	writeFields(fieldsSub)
+
+	l := len(fieldsDirect) + len(fieldsSub)
+	writeFields(fieldsDirect, l)
+	writeFields(fieldsSub, l)
 	if inline {
 		enc.wf("}")
 	}

vendor/github.com/BurntSushi/toml/error.go

@@ -67,21 +67,36 @@ type ParseError struct {
 // Position of an error.
 type Position struct {
 	Line  int // Line number, starting at 1.
+	Col   int // Error column, starting at 1.
 	Start int // Start of error, as byte offset starting at 0.
-	Len   int // Lenght in bytes.
+	Len   int // Length of the error in bytes.
+}
+
+func (p Position) withCol(tomlFile string) Position {
+	var (
+		pos   int
+		lines = strings.Split(tomlFile, "\n")
+	)
+	for i := range lines {
+		ll := len(lines[i]) + 1 // +1 for the removed newline
+		if pos+ll >= p.Start {
+			p.Col = p.Start - pos + 1
+			if p.Col < 1 { // Should never happen, but just in case.
+				p.Col = 1
+			}
+			break
+		}
+		pos += ll
+	}
+	return p
 }
 
 func (pe ParseError) Error() string {
-	msg := pe.Message
-	if msg == "" { // Error from errorf()
-		msg = pe.err.Error()
-	}
-
 	if pe.LastKey == "" {
-		return fmt.Sprintf("toml: line %d: %s", pe.Position.Line, msg)
+		return fmt.Sprintf("toml: line %d: %s", pe.Position.Line, pe.Message)
 	}
 	return fmt.Sprintf("toml: line %d (last key %q): %s",
-		pe.Position.Line, pe.LastKey, msg)
+		pe.Position.Line, pe.LastKey, pe.Message)
 }
 
 // ErrorWithPosition returns the error with detailed location context.
@@ -92,26 +107,19 @@ func (pe ParseError) ErrorWithPosition() string {
 		return pe.Error()
 	}
 
-	var (
-		lines = strings.Split(pe.input, "\n")
-		col   = pe.column(lines)
-		b     = new(strings.Builder)
-	)
-
-	msg := pe.Message
-	if msg == "" {
-		msg = pe.err.Error()
-	}
-
 	// TODO: don't show control characters as literals? This may not show up
 	// well everywhere.
 
+	var (
+		lines = strings.Split(pe.input, "\n")
+		b     = new(strings.Builder)
+	)
 	if pe.Position.Len == 1 {
 		fmt.Fprintf(b, "toml: error: %s\n\nAt line %d, column %d:\n\n",
-			msg, pe.Position.Line, col+1)
+			pe.Message, pe.Position.Line, pe.Position.Col)
 	} else {
 		fmt.Fprintf(b, "toml: error: %s\n\nAt line %d, column %d-%d:\n\n",
-			msg, pe.Position.Line, col, col+pe.Position.Len)
+			pe.Message, pe.Position.Line, pe.Position.Col, pe.Position.Col+pe.Position.Len-1)
 	}
 	if pe.Position.Line > 2 {
 		fmt.Fprintf(b, "% 7d | %s\n", pe.Position.Line-2, expandTab(lines[pe.Position.Line-3]))
@@ -129,7 +137,7 @@ func (pe ParseError) ErrorWithPosition() string {
 	diff := len(expanded) - len(lines[pe.Position.Line-1])
 
 	fmt.Fprintf(b, "% 7d | %s\n", pe.Position.Line, expanded)
-	fmt.Fprintf(b, "% 10s%s%s\n", "", strings.Repeat(" ", col+diff), strings.Repeat("^", pe.Position.Len))
+	fmt.Fprintf(b, "% 10s%s%s\n", "", strings.Repeat(" ", pe.Position.Col-1+diff), strings.Repeat("^", pe.Position.Len))
 	return b.String()
 }
 
@@ -151,23 +159,6 @@ func (pe ParseError) ErrorWithUsage() string {
 	return m
 }
 
-func (pe ParseError) column(lines []string) int {
-	var pos, col int
-	for i := range lines {
-		ll := len(lines[i]) + 1 // +1 for the removed newline
-		if pos+ll >= pe.Position.Start {
-			col = pe.Position.Start - pos
-			if col < 0 { // Should never happen, but just in case.
-				col = 0
-			}
-			break
-		}
-		pos += ll
-	}
-
-	return col
-}
-
 func expandTab(s string) string {
 	var (
 		b    strings.Builder

vendor/github.com/BurntSushi/toml/lex.go

@@ -275,7 +275,9 @@ func (lx *lexer) errorPos(start, length int, err error) stateFn {
 func (lx *lexer) errorf(format string, values ...any) stateFn {
 	if lx.atEOF {
 		pos := lx.getPos()
-		pos.Line--
+		if lx.pos >= 1 && lx.input[lx.pos-1] == '\n' {
+			pos.Line--
+		}
 		pos.Len = 1
 		pos.Start = lx.pos - 1
 		lx.items <- item{typ: itemError, pos: pos, err: fmt.Errorf(format, values...)}
@@ -492,6 +494,9 @@ func lexKeyEnd(lx *lexer) stateFn {
 		lx.emit(itemKeyEnd)
 		return lexSkip(lx, lexValue)
 	default:
+		if r == '\n' {
+			return lx.errorPrevLine(fmt.Errorf("expected '.' or '=', but got %q instead", r))
+		}
 		return lx.errorf("expected '.' or '=', but got %q instead", r)
 	}
 }
@@ -560,6 +565,9 @@ func lexValue(lx *lexer) stateFn {
 	if r == eof {
 		return lx.errorf("unexpected EOF; expected value")
 	}
+	if r == '\n' {
+		return lx.errorPrevLine(fmt.Errorf("expected value but found %q instead", r))
+	}
 	return lx.errorf("expected value but found %q instead", r)
 }
 
@@ -1111,7 +1119,7 @@ func lexBaseNumberOrDate(lx *lexer) stateFn {
 	case 'x':
 		r = lx.peek()
 		if !isHex(r) {
-			lx.errorf("not a hexidecimal number: '%s%c'", lx.current(), r)
+			lx.errorf("not a hexadecimal number: '%s%c'", lx.current(), r)
 		}
 		return lexHexInteger
 	}
@@ -1259,23 +1267,6 @@ func isBinary(r rune) bool { return r == '0' || r == '1' }
 func isOctal(r rune) bool  { return r >= '0' && r <= '7' }
 func isHex(r rune) bool    { return (r >= '0' && r <= '9') || (r|0x20 >= 'a' && r|0x20 <= 'f') }
 func isBareKeyChar(r rune, tomlNext bool) bool {
-	if tomlNext {
-		return (r >= 'A' && r <= 'Z') ||
-			(r >= 'a' && r <= 'z') ||
-			(r >= '0' && r <= '9') ||
-			r == '_' || r == '-' ||
-			r == 0xb2 || r == 0xb3 || r == 0xb9 || (r >= 0xbc && r <= 0xbe) ||
-			(r >= 0xc0 && r <= 0xd6) || (r >= 0xd8 && r <= 0xf6) || (r >= 0xf8 && r <= 0x037d) ||
-			(r >= 0x037f && r <= 0x1fff) ||
-			(r >= 0x200c && r <= 0x200d) || (r >= 0x203f && r <= 0x2040) ||
-			(r >= 0x2070 && r <= 0x218f) || (r >= 0x2460 && r <= 0x24ff) ||
-			(r >= 0x2c00 && r <= 0x2fef) || (r >= 0x3001 && r <= 0xd7ff) ||
-			(r >= 0xf900 && r <= 0xfdcf) || (r >= 0xfdf0 && r <= 0xfffd) ||
-			(r >= 0x10000 && r <= 0xeffff)
-	}
-
-	return (r >= 'A' && r <= 'Z') ||
-		(r >= 'a' && r <= 'z') ||
-		(r >= '0' && r <= '9') ||
-		r == '_' || r == '-'
+	return (r >= 'A' && r <= 'Z') || (r >= 'a' && r <= 'z') ||
+		(r >= '0' && r <= '9') || r == '_' || r == '-'
 }

vendor/github.com/BurntSushi/toml/meta.go

@@ -135,9 +135,6 @@ func (k Key) maybeQuoted(i int) string {
 
 // Like append(), but only increase the cap by 1.
 func (k Key) add(piece string) Key {
-	if cap(k) > len(k) {
-		return append(k, piece)
-	}
 	newKey := make(Key, len(k)+1)
 	copy(newKey, k)
 	newKey[len(k)] = piece

vendor/github.com/BurntSushi/toml/parse.go

@@ -50,7 +50,6 @@ func parse(data string) (p *parser, err error) {
 	// it anyway.
 	if strings.HasPrefix(data, "\xff\xfe") || strings.HasPrefix(data, "\xfe\xff") { // UTF-16
 		data = data[2:]
-		//lint:ignore S1017 https://github.com/dominikh/go-tools/issues/1447
 	} else if strings.HasPrefix(data, "\xef\xbb\xbf") { // UTF-8
 		data = data[3:]
 	}
@@ -65,7 +64,7 @@ func parse(data string) (p *parser, err error) {
 	if i := strings.IndexRune(data[:ex], 0); i > -1 {
 		return nil, ParseError{
 			Message:  "files cannot contain NULL bytes; probably using UTF-16; TOML files must be UTF-8",
-			Position: Position{Line: 1, Start: i, Len: 1},
+			Position: Position{Line: 1, Col: 1, Start: i, Len: 1},
 			Line:     1,
 			input:    data,
 		}
@@ -92,8 +91,9 @@ func parse(data string) (p *parser, err error) {
 
 func (p *parser) panicErr(it item, err error) {
 	panic(ParseError{
+		Message:  err.Error(),
 		err:      err,
-		Position: it.pos,
+		Position: it.pos.withCol(p.lx.input),
 		Line:     it.pos.Len,
 		LastKey:  p.current(),
 	})
@@ -102,7 +102,7 @@ func (p *parser) panicErr(it item, err error) {
 func (p *parser) panicItemf(it item, format string, v ...any) {
 	panic(ParseError{
 		Message:  fmt.Sprintf(format, v...),
-		Position: it.pos,
+		Position: it.pos.withCol(p.lx.input),
 		Line:     it.pos.Len,
 		LastKey:  p.current(),
 	})
@@ -111,7 +111,7 @@ func (p *parser) panicItemf(it item, format string, v ...any) {
 func (p *parser) panicf(format string, v ...any) {
 	panic(ParseError{
 		Message:  fmt.Sprintf(format, v...),
-		Position: p.pos,
+		Position: p.pos.withCol(p.lx.input),
 		Line:     p.pos.Line,
 		LastKey:  p.current(),
 	})
@@ -123,10 +123,11 @@ func (p *parser) next() item {
 	if it.typ == itemError {
 		if it.err != nil {
 			panic(ParseError{
-				Position: it.pos,
+				Message:  it.err.Error(),
+				err:      it.err,
+				Position: it.pos.withCol(p.lx.input),
 				Line:     it.pos.Line,
 				LastKey:  p.current(),
-				err:      it.err,
 			})
 		}
 
@@ -527,7 +528,7 @@ func numUnderscoresOK(s string) bool {
 			}
 		}
 
-		// isHexis a superset of all the permissable characters surrounding an
+		// isHex is a superset of all the permissible characters surrounding an
 		// underscore.
 		accept = isHex(r)
 	}

vendor/github.com/ProtonMail/go-crypto/openpgp/errors/errors.go

@@ -180,6 +180,16 @@ func (dke ErrMalformedMessage) Error() string {
 	return "openpgp: malformed message " + string(dke)
 }
 
+type messageTooLargeError int
+
+func (e messageTooLargeError) Error() string {
+	return "openpgp: decompressed message size exceeds provided limit"
+}
+
+// ErrMessageTooLarge is returned if the read data from
+// a compressed packet exceeds the provided limit.
+var ErrMessageTooLarge error = messageTooLargeError(0)
+
 // ErrEncryptionKeySelection is returned if encryption key selection fails (v2 API).
 type ErrEncryptionKeySelection struct {
 	PrimaryKeyId      string

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/aead_config.go

@@ -37,7 +37,7 @@ func (conf *AEADConfig) Mode() AEADMode {
 
 // ChunkSizeByte returns the byte indicating the chunk size. The effective
 // chunk size is computed with the formula uint64(1) << (chunkSizeByte + 6)
-// limit to 16 = 4 MiB
+// limit chunkSizeByte to 16 which equals to 2^22 = 4 MiB
 // https://www.ietf.org/archive/id/draft-ietf-openpgp-crypto-refresh-07.html#section-5.13.2
 func (conf *AEADConfig) ChunkSizeByte() byte {
 	if conf == nil || conf.ChunkSize == 0 {
@@ -49,8 +49,8 @@ func (conf *AEADConfig) ChunkSizeByte() byte {
 	switch {
 	case exponent < 6:
 		exponent = 6
-	case exponent > 16:
-		exponent = 16
+	case exponent > 22:
+		exponent = 22
 	}
 
 	return byte(exponent - 6)

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/compressed.go

@@ -98,6 +98,16 @@ func (c *Compressed) parse(r io.Reader) error {
 	return err
 }
 
+// LimitedBodyReader wraps the provided body reader with a limiter that restricts
+// the number of bytes read to the specified limit.
+// If limit is nil, the reader is unbounded.
+func (c *Compressed) LimitedBodyReader(limit *int64) io.Reader {
+	if limit == nil {
+		return c.Body
+	}
+	return &LimitReader{R: c.Body, N: *limit}
+}
+
 // compressedWriterCloser represents the serialized compression stream
 // header and the compressor. Its Close() method ensures that both the
 // compressor and serialized stream header are closed. Its Write()
@@ -159,3 +169,24 @@ func SerializeCompressed(w io.WriteCloser, algo CompressionAlgo, cc *Compression
 
 	return
 }
+
+// LimitReader is an io.Reader that fails with MessageToLarge if read bytes exceed N.
+type LimitReader struct {
+	R io.Reader // underlying reader
+	N int64     // max bytes allowed
+}
+
+func (l *LimitReader) Read(p []byte) (int, error) {
+	if l.N <= 0 {
+		return 0, errors.ErrMessageTooLarge
+	}
+
+	n, err := l.R.Read(p)
+	l.N -= int64(n)
+
+	if err == nil && l.N <= 0 {
+		err = errors.ErrMessageTooLarge
+	}
+
+	return n, err
+}

vendor/github.com/ProtonMail/go-crypto/openpgp/packet/config.go

@@ -178,6 +178,11 @@ type Config struct {
 	// When set to true, a key without flags is treated as if all flags are enabled.
 	// This behavior is consistent with GPG.
 	InsecureAllowAllKeyFlagsWhenMissing bool
+
+	// MaxDecompressedMessageSize specifies the maximum number of bytes that can be
+	// read from a compressed packet. This serves as an upper limit to prevent
+	// excessively large decompressed messages.
+	MaxDecompressedMessageSize *int64
 }
 
 func (c *Config) Random() io.Reader {
@@ -415,6 +420,13 @@ func (c *Config) AllowAllKeyFlagsWhenMissing() bool {
 	return c.InsecureAllowAllKeyFlagsWhenMissing
 }
 
+func (c *Config) DecompressedMessageSizeLimit() *int64 {
+	if c == nil {
+		return nil
+	}
+	return c.MaxDecompressedMessageSize
+}
+
 // BoolPointer is a helper function to set a boolean pointer in the Config.
 // e.g., config.CheckPacketSequence = BoolPointer(true)
 func BoolPointer(value bool) *bool {

vendor/github.com/ProtonMail/go-crypto/openpgp/read.go

@@ -259,7 +259,7 @@ FindLiteralData:
 		}
 		switch p := p.(type) {
 		case *packet.Compressed:
-			if err := packets.Push(p.Body); err != nil {
+			if err := packets.Push(p.LimitedBodyReader(config.DecompressedMessageSizeLimit())); err != nil {
 				return nil, err
 			}
 		case *packet.OnePassSignature:

vendor/github.com/ProtonMail/go-crypto/openpgp/write.go

@@ -253,34 +253,12 @@ func writeAndSign(payload io.WriteCloser, candidateHashes []uint8, signed *Entit
 	}
 
 	var hash crypto.Hash
-	for _, hashId := range candidateHashes {
-		if h, ok := algorithm.HashIdToHash(hashId); ok && h.Available() {
-			hash = h
-			break
-		}
-	}
-
-	// If the hash specified by config is a candidate, we'll use that.
-	if configuredHash := config.Hash(); configuredHash.Available() {
-		for _, hashId := range candidateHashes {
-			if h, ok := algorithm.HashIdToHash(hashId); ok && h == configuredHash {
-				hash = h
-				break
-			}
-		}
-	}
-
-	if hash == 0 {
-		hashId := candidateHashes[0]
-		name, ok := algorithm.HashIdToString(hashId)
-		if !ok {
-			name = "#" + strconv.Itoa(int(hashId))
-		}
-		return nil, errors.InvalidArgumentError("cannot encrypt because no candidate hash functions are compiled in. (Wanted " + name + " in this case.)")
-	}
-
 	var salt []byte
 	if signer != nil {
+		if hash, err = selectHash(candidateHashes, config.Hash(), signer); err != nil {
+			return nil, err
+		}
+
 		var opsVersion = 3
 		if signer.Version == 6 {
 			opsVersion = signer.Version
@@ -558,13 +536,34 @@ func (s signatureWriter) Close() error {
 	return s.encryptedData.Close()
 }
 
+func selectHashForSigningKey(config *packet.Config, signer *packet.PublicKey) crypto.Hash {
+	acceptableHashes := acceptableHashesToWrite(signer)
+	hash, ok := algorithm.HashToHashId(config.Hash())
+	if !ok {
+		return config.Hash()
+	}
+	for _, acceptableHashes := range acceptableHashes {
+		if acceptableHashes == hash {
+			return config.Hash()
+		}
+	}
+	if len(acceptableHashes) > 0 {
+		defaultAcceptedHash, ok := algorithm.HashIdToHash(acceptableHashes[0])
+		if ok {
+			return defaultAcceptedHash
+		}
+	}
+	return config.Hash()
+}
+
 func createSignaturePacket(signer *packet.PublicKey, sigType packet.SignatureType, config *packet.Config) *packet.Signature {
 	sigLifetimeSecs := config.SigLifetime()
+	hash := selectHashForSigningKey(config, signer)
 	return &packet.Signature{
 		Version:           signer.Version,
 		SigType:           sigType,
 		PubKeyAlgo:        signer.PubKeyAlgo,
-		Hash:              config.Hash(),
+		Hash:              hash,
 		CreationTime:      config.Now(),
 		IssuerKeyId:       &signer.KeyId,
 		IssuerFingerprint: signer.Fingerprint,
@@ -618,3 +617,74 @@ func handleCompression(compressed io.WriteCloser, candidateCompression []uint8,
 	}
 	return data, nil
 }
+
+// selectHash selects the preferred hash given the candidateHashes and the configuredHash
+func selectHash(candidateHashes []byte, configuredHash crypto.Hash, signer *packet.PrivateKey) (hash crypto.Hash, err error) {
+	acceptableHashes := acceptableHashesToWrite(&signer.PublicKey)
+	candidateHashes = intersectPreferences(acceptableHashes, candidateHashes)
+
+	for _, hashId := range candidateHashes {
+		if h, ok := algorithm.HashIdToHash(hashId); ok && h.Available() {
+			hash = h
+			break
+		}
+	}
+
+	// If the hash specified by config is a candidate, we'll use that.
+	if configuredHash.Available() {
+		for _, hashId := range candidateHashes {
+			if h, ok := algorithm.HashIdToHash(hashId); ok && h == configuredHash {
+				hash = h
+				break
+			}
+		}
+	}
+
+	if hash == 0 {
+		if len(acceptableHashes) > 0 {
+			if h, ok := algorithm.HashIdToHash(acceptableHashes[0]); ok {
+				hash = h
+			} else {
+				return 0, errors.UnsupportedError("no candidate hash functions are compiled in.")
+			}
+		} else {
+			return 0, errors.UnsupportedError("no candidate hash functions are compiled in.")
+		}
+	}
+	return
+}
+
+func acceptableHashesToWrite(singingKey *packet.PublicKey) []uint8 {
+	switch singingKey.PubKeyAlgo {
+	case packet.PubKeyAlgoEd448:
+		return []uint8{
+			hashToHashId(crypto.SHA512),
+			hashToHashId(crypto.SHA3_512),
+		}
+	case packet.PubKeyAlgoECDSA, packet.PubKeyAlgoEdDSA:
+		if curve, err := singingKey.Curve(); err == nil {
+			if curve == packet.Curve448 ||
+				curve == packet.CurveNistP521 ||
+				curve == packet.CurveBrainpoolP512 {
+				return []uint8{
+					hashToHashId(crypto.SHA512),
+					hashToHashId(crypto.SHA3_512),
+				}
+			} else if curve == packet.CurveBrainpoolP384 ||
+				curve == packet.CurveNistP384 {
+				return []uint8{
+					hashToHashId(crypto.SHA384),
+					hashToHashId(crypto.SHA512),
+					hashToHashId(crypto.SHA3_512),
+				}
+			}
+		}
+	}
+	return []uint8{
+		hashToHashId(crypto.SHA256),
+		hashToHashId(crypto.SHA384),
+		hashToHashId(crypto.SHA512),
+		hashToHashId(crypto.SHA3_256),
+		hashToHashId(crypto.SHA3_512),
+	}
+}

vendor/github.com/cenkalti/backoff/v4/context.go

@@ -1,62 +0,0 @@
-package backoff
-
-import (
-	"context"
-	"time"
-)
-
-// BackOffContext is a backoff policy that stops retrying after the context
-// is canceled.
-type BackOffContext interface { // nolint: golint
-	BackOff
-	Context() context.Context
-}
-
-type backOffContext struct {
-	BackOff
-	ctx context.Context
-}
-
-// WithContext returns a BackOffContext with context ctx
-//
-// ctx must not be nil
-func WithContext(b BackOff, ctx context.Context) BackOffContext { // nolint: golint
-	if ctx == nil {
-		panic("nil context")
-	}
-
-	if b, ok := b.(*backOffContext); ok {
-		return &backOffContext{
-			BackOff: b.BackOff,
-			ctx:     ctx,
-		}
-	}
-
-	return &backOffContext{
-		BackOff: b,
-		ctx:     ctx,
-	}
-}
-
-func getContext(b BackOff) context.Context {
-	if cb, ok := b.(BackOffContext); ok {
-		return cb.Context()
-	}
-	if tb, ok := b.(*backOffTries); ok {
-		return getContext(tb.delegate)
-	}
-	return context.Background()
-}
-
-func (b *backOffContext) Context() context.Context {
-	return b.ctx
-}
-
-func (b *backOffContext) NextBackOff() time.Duration {
-	select {
-	case <-b.ctx.Done():
-		return Stop
-	default:
-		return b.BackOff.NextBackOff()
-	}
-}

vendor/github.com/cenkalti/backoff/v4/exponential.go

@@ -1,216 +0,0 @@
-package backoff
-
-import (
-	"math/rand"
-	"time"
-)
-
-/*
-ExponentialBackOff is a backoff implementation that increases the backoff
-period for each retry attempt using a randomization function that grows exponentially.
-
-NextBackOff() is calculated using the following formula:
-
- randomized interval =
-     RetryInterval * (random value in range [1 - RandomizationFactor, 1 + RandomizationFactor])
-
-In other words NextBackOff() will range between the randomization factor
-percentage below and above the retry interval.
-
-For example, given the following parameters:
-
- RetryInterval = 2
- RandomizationFactor = 0.5
- Multiplier = 2
-
-the actual backoff period used in the next retry attempt will range between 1 and 3 seconds,
-multiplied by the exponential, that is, between 2 and 6 seconds.
-
-Note: MaxInterval caps the RetryInterval and not the randomized interval.
-
-If the time elapsed since an ExponentialBackOff instance is created goes past the
-MaxElapsedTime, then the method NextBackOff() starts returning backoff.Stop.
-
-The elapsed time can be reset by calling Reset().
-
-Example: Given the following default arguments, for 10 tries the sequence will be,
-and assuming we go over the MaxElapsedTime on the 10th try:
-
- Request #  RetryInterval (seconds)  Randomized Interval (seconds)
-
-  1          0.5                     [0.25,   0.75]
-  2          0.75                    [0.375,  1.125]
-  3          1.125                   [0.562,  1.687]
-  4          1.687                   [0.8435, 2.53]
-  5          2.53                    [1.265,  3.795]
-  6          3.795                   [1.897,  5.692]
-  7          5.692                   [2.846,  8.538]
-  8          8.538                   [4.269, 12.807]
-  9         12.807                   [6.403, 19.210]
- 10         19.210                   backoff.Stop
-
-Note: Implementation is not thread-safe.
-*/
-type ExponentialBackOff struct {
-	InitialInterval     time.Duration
-	RandomizationFactor float64
-	Multiplier          float64
-	MaxInterval         time.Duration
-	// After MaxElapsedTime the ExponentialBackOff returns Stop.
-	// It never stops if MaxElapsedTime == 0.
-	MaxElapsedTime time.Duration
-	Stop           time.Duration
-	Clock          Clock
-
-	currentInterval time.Duration
-	startTime       time.Time
-}
-
-// Clock is an interface that returns current time for BackOff.
-type Clock interface {
-	Now() time.Time
-}
-
-// ExponentialBackOffOpts is a function type used to configure ExponentialBackOff options.
-type ExponentialBackOffOpts func(*ExponentialBackOff)
-
-// Default values for ExponentialBackOff.
-const (
-	DefaultInitialInterval     = 500 * time.Millisecond
-	DefaultRandomizationFactor = 0.5
-	DefaultMultiplier          = 1.5
-	DefaultMaxInterval         = 60 * time.Second
-	DefaultMaxElapsedTime      = 15 * time.Minute
-)
-
-// NewExponentialBackOff creates an instance of ExponentialBackOff using default values.
-func NewExponentialBackOff(opts ...ExponentialBackOffOpts) *ExponentialBackOff {
-	b := &ExponentialBackOff{
-		InitialInterval:     DefaultInitialInterval,
-		RandomizationFactor: DefaultRandomizationFactor,
-		Multiplier:          DefaultMultiplier,
-		MaxInterval:         DefaultMaxInterval,
-		MaxElapsedTime:      DefaultMaxElapsedTime,
-		Stop:                Stop,
-		Clock:               SystemClock,
-	}
-	for _, fn := range opts {
-		fn(b)
-	}
-	b.Reset()
-	return b
-}
-
-// WithInitialInterval sets the initial interval between retries.
-func WithInitialInterval(duration time.Duration) ExponentialBackOffOpts {
-	return func(ebo *ExponentialBackOff) {
-		ebo.InitialInterval = duration
-	}
-}
-
-// WithRandomizationFactor sets the randomization factor to add jitter to intervals.
-func WithRandomizationFactor(randomizationFactor float64) ExponentialBackOffOpts {
-	return func(ebo *ExponentialBackOff) {
-		ebo.RandomizationFactor = randomizationFactor
-	}
-}
-
-// WithMultiplier sets the multiplier for increasing the interval after each retry.
-func WithMultiplier(multiplier float64) ExponentialBackOffOpts {
-	return func(ebo *ExponentialBackOff) {
-		ebo.Multiplier = multiplier
-	}
-}
-
-// WithMaxInterval sets the maximum interval between retries.
-func WithMaxInterval(duration time.Duration) ExponentialBackOffOpts {
-	return func(ebo *ExponentialBackOff) {
-		ebo.MaxInterval = duration
-	}
-}
-
-// WithMaxElapsedTime sets the maximum total time for retries.
-func WithMaxElapsedTime(duration time.Duration) ExponentialBackOffOpts {
-	return func(ebo *ExponentialBackOff) {
-		ebo.MaxElapsedTime = duration
-	}
-}
-
-// WithRetryStopDuration sets the duration after which retries should stop.
-func WithRetryStopDuration(duration time.Duration) ExponentialBackOffOpts {
-	return func(ebo *ExponentialBackOff) {
-		ebo.Stop = duration
-	}
-}
-
-// WithClockProvider sets the clock used to measure time.
-func WithClockProvider(clock Clock) ExponentialBackOffOpts {
-	return func(ebo *ExponentialBackOff) {
-		ebo.Clock = clock
-	}
-}
-
-type systemClock struct{}
-
-func (t systemClock) Now() time.Time {
-	return time.Now()
-}
-
-// SystemClock implements Clock interface that uses time.Now().
-var SystemClock = systemClock{}
-
-// Reset the interval back to the initial retry interval and restarts the timer.
-// Reset must be called before using b.
-func (b *ExponentialBackOff) Reset() {
-	b.currentInterval = b.InitialInterval
-	b.startTime = b.Clock.Now()
-}
-
-// NextBackOff calculates the next backoff interval using the formula:
-// 	Randomized interval = RetryInterval * (1 ± RandomizationFactor)
-func (b *ExponentialBackOff) NextBackOff() time.Duration {
-	// Make sure we have not gone over the maximum elapsed time.
-	elapsed := b.GetElapsedTime()
-	next := getRandomValueFromInterval(b.RandomizationFactor, rand.Float64(), b.currentInterval)
-	b.incrementCurrentInterval()
-	if b.MaxElapsedTime != 0 && elapsed+next > b.MaxElapsedTime {
-		return b.Stop
-	}
-	return next
-}
-
-// GetElapsedTime returns the elapsed time since an ExponentialBackOff instance
-// is created and is reset when Reset() is called.
-//
-// The elapsed time is computed using time.Now().UnixNano(). It is
-// safe to call even while the backoff policy is used by a running
-// ticker.
-func (b *ExponentialBackOff) GetElapsedTime() time.Duration {
-	return b.Clock.Now().Sub(b.startTime)
-}
-
-// Increments the current interval by multiplying it with the multiplier.
-func (b *ExponentialBackOff) incrementCurrentInterval() {
-	// Check for overflow, if overflow is detected set the current interval to the max interval.
-	if float64(b.currentInterval) >= float64(b.MaxInterval)/b.Multiplier {
-		b.currentInterval = b.MaxInterval
-	} else {
-		b.currentInterval = time.Duration(float64(b.currentInterval) * b.Multiplier)
-	}
-}
-
-// Returns a random value from the following interval:
-// 	[currentInterval - randomizationFactor * currentInterval, currentInterval + randomizationFactor * currentInterval].
-func getRandomValueFromInterval(randomizationFactor, random float64, currentInterval time.Duration) time.Duration {
-	if randomizationFactor == 0 {
-		return currentInterval // make sure no randomness is used when randomizationFactor is 0.
-	}
-	var delta = randomizationFactor * float64(currentInterval)
-	var minInterval = float64(currentInterval) - delta
-	var maxInterval = float64(currentInterval) + delta
-
-	// Get a random value from the range [minInterval, maxInterval].
-	// The formula used below has a +1 because if the minInterval is 1 and the maxInterval is 3 then
-	// we want a 33% chance for selecting either 1, 2 or 3.
-	return time.Duration(minInterval + (random * (maxInterval - minInterval + 1)))
-}

vendor/github.com/cenkalti/backoff/v4/retry.go

@@ -1,146 +0,0 @@
-package backoff
-
-import (
-	"errors"
-	"time"
-)
-
-// An OperationWithData is executing by RetryWithData() or RetryNotifyWithData().
-// The operation will be retried using a backoff policy if it returns an error.
-type OperationWithData[T any] func() (T, error)
-
-// An Operation is executing by Retry() or RetryNotify().
-// The operation will be retried using a backoff policy if it returns an error.
-type Operation func() error
-
-func (o Operation) withEmptyData() OperationWithData[struct{}] {
-	return func() (struct{}, error) {
-		return struct{}{}, o()
-	}
-}
-
-// Notify is a notify-on-error function. It receives an operation error and
-// backoff delay if the operation failed (with an error).
-//
-// NOTE that if the backoff policy stated to stop retrying,
-// the notify function isn't called.
-type Notify func(error, time.Duration)
-
-// Retry the operation o until it does not return error or BackOff stops.
-// o is guaranteed to be run at least once.
-//
-// If o returns a *PermanentError, the operation is not retried, and the
-// wrapped error is returned.
-//
-// Retry sleeps the goroutine for the duration returned by BackOff after a
-// failed operation returns.
-func Retry(o Operation, b BackOff) error {
-	return RetryNotify(o, b, nil)
-}
-
-// RetryWithData is like Retry but returns data in the response too.
-func RetryWithData[T any](o OperationWithData[T], b BackOff) (T, error) {
-	return RetryNotifyWithData(o, b, nil)
-}
-
-// RetryNotify calls notify function with the error and wait duration
-// for each failed attempt before sleep.
-func RetryNotify(operation Operation, b BackOff, notify Notify) error {
-	return RetryNotifyWithTimer(operation, b, notify, nil)
-}
-
-// RetryNotifyWithData is like RetryNotify but returns data in the response too.
-func RetryNotifyWithData[T any](operation OperationWithData[T], b BackOff, notify Notify) (T, error) {
-	return doRetryNotify(operation, b, notify, nil)
-}
-
-// RetryNotifyWithTimer calls notify function with the error and wait duration using the given Timer
-// for each failed attempt before sleep.
-// A default timer that uses system timer is used when nil is passed.
-func RetryNotifyWithTimer(operation Operation, b BackOff, notify Notify, t Timer) error {
-	_, err := doRetryNotify(operation.withEmptyData(), b, notify, t)
-	return err
-}
-
-// RetryNotifyWithTimerAndData is like RetryNotifyWithTimer but returns data in the response too.
-func RetryNotifyWithTimerAndData[T any](operation OperationWithData[T], b BackOff, notify Notify, t Timer) (T, error) {
-	return doRetryNotify(operation, b, notify, t)
-}
-
-func doRetryNotify[T any](operation OperationWithData[T], b BackOff, notify Notify, t Timer) (T, error) {
-	var (
-		err  error
-		next time.Duration
-		res  T
-	)
-	if t == nil {
-		t = &defaultTimer{}
-	}
-
-	defer func() {
-		t.Stop()
-	}()
-
-	ctx := getContext(b)
-
-	b.Reset()
-	for {
-		res, err = operation()
-		if err == nil {
-			return res, nil
-		}
-
-		var permanent *PermanentError
-		if errors.As(err, &permanent) {
-			return res, permanent.Err
-		}
-
-		if next = b.NextBackOff(); next == Stop {
-			if cerr := ctx.Err(); cerr != nil {
-				return res, cerr
-			}
-
-			return res, err
-		}
-
-		if notify != nil {
-			notify(err, next)
-		}
-
-		t.Start(next)
-
-		select {
-		case <-ctx.Done():
-			return res, ctx.Err()
-		case <-t.C():
-		}
-	}
-}
-
-// PermanentError signals that the operation should not be retried.
-type PermanentError struct {
-	Err error
-}
-
-func (e *PermanentError) Error() string {
-	return e.Err.Error()
-}
-
-func (e *PermanentError) Unwrap() error {
-	return e.Err
-}
-
-func (e *PermanentError) Is(target error) bool {
-	_, ok := target.(*PermanentError)
-	return ok
-}
-
-// Permanent wraps the given err in a *PermanentError.
-func Permanent(err error) error {
-	if err == nil {
-		return nil
-	}
-	return &PermanentError{
-		Err: err,
-	}
-}

vendor/github.com/cenkalti/backoff/v4/tries.go

@@ -1,38 +0,0 @@
-package backoff
-
-import "time"
-
-/*
-WithMaxRetries creates a wrapper around another BackOff, which will
-return Stop if NextBackOff() has been called too many times since
-the last time Reset() was called
-
-Note: Implementation is not thread-safe.
-*/
-func WithMaxRetries(b BackOff, max uint64) BackOff {
-	return &backOffTries{delegate: b, maxTries: max}
-}
-
-type backOffTries struct {
-	delegate BackOff
-	maxTries uint64
-	numTries uint64
-}
-
-func (b *backOffTries) NextBackOff() time.Duration {
-	if b.maxTries == 0 {
-		return Stop
-	}
-	if b.maxTries > 0 {
-		if b.maxTries <= b.numTries {
-			return Stop
-		}
-		b.numTries++
-	}
-	return b.delegate.NextBackOff()
-}
-
-func (b *backOffTries) Reset() {
-	b.numTries = 0
-	b.delegate.Reset()
-}

vendor/github.com/cenkalti/backoff/v5/CHANGELOG.md

@@ -0,0 +1,29 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [5.0.0] - 2024-12-19
+
+### Added
+
+- RetryAfterError can be returned from an operation to indicate how long to wait before the next retry.
+
+### Changed
+
+- Retry function now accepts additional options for specifying max number of tries and max elapsed time.
+- Retry function now accepts a context.Context.
+- Operation function signature changed to return result (any type) and error.
+
+### Removed
+
+- RetryNotify* and RetryWithData functions. Only single Retry function remains.
+- Optional arguments from ExponentialBackoff constructor.
+- Clock and Timer interfaces.
+
+### Fixed
+
+- The original error is returned from Retry if there's a PermanentError. (#144)
+- The Retry function respects the wrapped PermanentError. (#140)

vendor/github.com/cenkalti/backoff/v5/README.md

@@ -1,4 +1,4 @@
-# Exponential Backoff [![GoDoc][godoc image]][godoc] [![Coverage Status][coveralls image]][coveralls]
+# Exponential Backoff [![GoDoc][godoc image]][godoc]
 
 This is a Go port of the exponential backoff algorithm from [Google's HTTP Client Library for Java][google-http-java-client].
 
@@ -9,9 +9,11 @@ The retries exponentially increase and stop increasing when a certain threshold
 
 ## Usage
 
-Import path is `github.com/cenkalti/backoff/v4`. Please note the version part at the end.
+Import path is `github.com/cenkalti/backoff/v5`. Please note the version part at the end.
 
-Use https://pkg.go.dev/github.com/cenkalti/backoff/v4 to view the documentation.
+For most cases, use `Retry` function. See [example_test.go][example] for an example.
+
+If you have specific needs, copy `Retry` function (from [retry.go][retry-src]) into your code and modify it as needed.
 
 ## Contributing
 
@@ -19,12 +21,11 @@ Use https://pkg.go.dev/github.com/cenkalti/backoff/v4 to view the documentation.
 * Please don't send a PR without opening an issue and discussing it first.
 * If proposed change is not a common use case, I will probably not accept it.
 
-[godoc]: https://pkg.go.dev/github.com/cenkalti/backoff/v4
+[godoc]: https://pkg.go.dev/github.com/cenkalti/backoff/v5
 [godoc image]: https://godoc.org/github.com/cenkalti/backoff?status.png
-[coveralls]: https://coveralls.io/github/cenkalti/backoff?branch=master
-[coveralls image]: https://coveralls.io/repos/github/cenkalti/backoff/badge.svg?branch=master
 
 [google-http-java-client]: https://github.com/google/google-http-java-client/blob/da1aa993e90285ec18579f1553339b00e19b3ab5/google-http-client/src/main/java/com/google/api/client/util/ExponentialBackOff.java
 [exponential backoff wiki]: http://en.wikipedia.org/wiki/Exponential_backoff
 
-[advanced example]: https://pkg.go.dev/github.com/cenkalti/backoff/v4?tab=doc#pkg-examples
+[retry-src]: https://github.com/cenkalti/backoff/blob/v5/retry.go
+[example]: https://github.com/cenkalti/backoff/blob/v5/example_test.go

vendor/github.com/cenkalti/backoff/v5/backoff.go

@@ -15,16 +15,16 @@ import "time"
 // BackOff is a backoff policy for retrying an operation.
 type BackOff interface {
 	// NextBackOff returns the duration to wait before retrying the operation,
-	// or backoff. Stop to indicate that no more retries should be made.
+	// backoff.Stop to indicate that no more retries should be made.
 	//
 	// Example usage:
 	//
-	// 	duration := backoff.NextBackOff();
-	// 	if (duration == backoff.Stop) {
-	// 		// Do not retry operation.
-	// 	} else {
-	// 		// Sleep for duration and retry operation.
-	// 	}
+	//     duration := backoff.NextBackOff()
+	//     if duration == backoff.Stop {
+	//         // Do not retry operation.
+	//     } else {
+	//         // Sleep for duration and retry operation.
+	//     }
 	//
 	NextBackOff() time.Duration
 

vendor/github.com/cenkalti/backoff/v5/error.go

@@ -0,0 +1,46 @@
+package backoff
+
+import (
+	"fmt"
+	"time"
+)
+
+// PermanentError signals that the operation should not be retried.
+type PermanentError struct {
+	Err error
+}
+
+// Permanent wraps the given err in a *PermanentError.
+func Permanent(err error) error {
+	if err == nil {
+		return nil
+	}
+	return &PermanentError{
+		Err: err,
+	}
+}
+
+// Error returns a string representation of the Permanent error.
+func (e *PermanentError) Error() string {
+	return e.Err.Error()
+}
+
+// Unwrap returns the wrapped error.
+func (e *PermanentError) Unwrap() error {
+	return e.Err
+}
+
+// RetryAfterError signals that the operation should be retried after the given duration.
+type RetryAfterError struct {
+	Duration time.Duration
+}
+
+// RetryAfter returns a RetryAfter error that specifies how long to wait before retrying.
+func RetryAfter(seconds int) error {
+	return &RetryAfterError{Duration: time.Duration(seconds) * time.Second}
+}
+
+// Error returns a string representation of the RetryAfter error.
+func (e *RetryAfterError) Error() string {
+	return fmt.Sprintf("retry after %s", e.Duration)
+}

vendor/github.com/cenkalti/backoff/v5/exponential.go

@@ -0,0 +1,118 @@
+package backoff
+
+import (
+	"math/rand/v2"
+	"time"
+)
+
+/*
+ExponentialBackOff is a backoff implementation that increases the backoff
+period for each retry attempt using a randomization function that grows exponentially.
+
+NextBackOff() is calculated using the following formula:
+
+	randomized interval =
+	    RetryInterval * (random value in range [1 - RandomizationFactor, 1 + RandomizationFactor])
+
+In other words NextBackOff() will range between the randomization factor
+percentage below and above the retry interval.
+
+For example, given the following parameters:
+
+	RetryInterval = 2
+	RandomizationFactor = 0.5
+	Multiplier = 2
+
+the actual backoff period used in the next retry attempt will range between 1 and 3 seconds,
+multiplied by the exponential, that is, between 2 and 6 seconds.
+
+Note: MaxInterval caps the RetryInterval and not the randomized interval.
+
+Example: Given the following default arguments, for 9 tries the sequence will be:
+
+	Request #  RetryInterval (seconds)  Randomized Interval (seconds)
+
+	 1          0.5                     [0.25,   0.75]
+	 2          0.75                    [0.375,  1.125]
+	 3          1.125                   [0.562,  1.687]
+	 4          1.687                   [0.8435, 2.53]
+	 5          2.53                    [1.265,  3.795]
+	 6          3.795                   [1.897,  5.692]
+	 7          5.692                   [2.846,  8.538]
+	 8          8.538                   [4.269, 12.807]
+	 9         12.807                   [6.403, 19.210]
+
+Note: Implementation is not thread-safe.
+*/
+type ExponentialBackOff struct {
+	InitialInterval     time.Duration
+	RandomizationFactor float64
+	Multiplier          float64
+	MaxInterval         time.Duration
+
+	currentInterval time.Duration
+}
+
+// Default values for ExponentialBackOff.
+const (
+	DefaultInitialInterval     = 500 * time.Millisecond
+	DefaultRandomizationFactor = 0.5
+	DefaultMultiplier          = 1.5
+	DefaultMaxInterval         = 60 * time.Second
+)
+
+// NewExponentialBackOff creates an instance of ExponentialBackOff using default values.
+func NewExponentialBackOff() *ExponentialBackOff {
+	return &ExponentialBackOff{
+		InitialInterval:     DefaultInitialInterval,
+		RandomizationFactor: DefaultRandomizationFactor,
+		Multiplier:          DefaultMultiplier,
+		MaxInterval:         DefaultMaxInterval,
+	}
+}
+
+// Reset the interval back to the initial retry interval and restarts the timer.
+// Reset must be called before using b.
+func (b *ExponentialBackOff) Reset() {
+	b.currentInterval = b.InitialInterval
+}
+
+// NextBackOff calculates the next backoff interval using the formula:
+//
+//	Randomized interval = RetryInterval * (1 ± RandomizationFactor)
+func (b *ExponentialBackOff) NextBackOff() time.Duration {
+	if b.currentInterval == 0 {
+		b.currentInterval = b.InitialInterval
+	}
+
+	next := getRandomValueFromInterval(b.RandomizationFactor, rand.Float64(), b.currentInterval)
+	b.incrementCurrentInterval()
+	return next
+}
+
+// Increments the current interval by multiplying it with the multiplier.
+func (b *ExponentialBackOff) incrementCurrentInterval() {
+	// Check for overflow, if overflow is detected set the current interval to the max interval.
+	if float64(b.currentInterval) >= float64(b.MaxInterval)/b.Multiplier {
+		b.currentInterval = b.MaxInterval
+	} else {
+		b.currentInterval = time.Duration(float64(b.currentInterval) * b.Multiplier)
+	}
+}
+
+// Returns a random value from the following interval:
+//
+//	[currentInterval - randomizationFactor * currentInterval, currentInterval + randomizationFactor * currentInterval].
+func getRandomValueFromInterval(randomizationFactor, random float64, currentInterval time.Duration) time.Duration {
+	if randomizationFactor == 0 {
+		return currentInterval // make sure no randomness is used when randomizationFactor is 0.
+	}
+	var delta = randomizationFactor * float64(currentInterval)
+	var minInterval = float64(currentInterval) - delta
+	var maxInterval = float64(currentInterval) + delta
+
+	// Get a random value from the range [minInterval, maxInterval].
+	// The formula used below has a +1 because if the minInterval is 1 and the maxInterval is 3 then
+	// we want a 33% chance for selecting either 1, 2 or 3.
+	return time.Duration(minInterval + (random * (maxInterval - minInterval + 1)))
+}

vendor/github.com/cenkalti/backoff/v5/retry.go

@@ -0,0 +1,139 @@
+package backoff
+
+import (
+	"context"
+	"errors"
+	"time"
+)
+
+// DefaultMaxElapsedTime sets a default limit for the total retry duration.
+const DefaultMaxElapsedTime = 15 * time.Minute
+
+// Operation is a function that attempts an operation and may be retried.
+type Operation[T any] func() (T, error)
+
+// Notify is a function called on operation error with the error and backoff duration.
+type Notify func(error, time.Duration)
+
+// retryOptions holds configuration settings for the retry mechanism.
+type retryOptions struct {
+	BackOff        BackOff       // Strategy for calculating backoff periods.
+	Timer          timer         // Timer to manage retry delays.
+	Notify         Notify        // Optional function to notify on each retry error.
+	MaxTries       uint          // Maximum number of retry attempts.
+	MaxElapsedTime time.Duration // Maximum total time for all retries.
+}
+
+type RetryOption func(*retryOptions)
+
+// WithBackOff configures a custom backoff strategy.
+func WithBackOff(b BackOff) RetryOption {
+	return func(args *retryOptions) {
+		args.BackOff = b
+	}
+}
+
+// withTimer sets a custom timer for managing delays between retries.
+func withTimer(t timer) RetryOption {
+	return func(args *retryOptions) {
+		args.Timer = t
+	}
+}
+
+// WithNotify sets a notification function to handle retry errors.
+func WithNotify(n Notify) RetryOption {
+	return func(args *retryOptions) {
+		args.Notify = n
+	}
+}
+
+// WithMaxTries limits the number of all attempts.
+func WithMaxTries(n uint) RetryOption {
+	return func(args *retryOptions) {
+		args.MaxTries = n
+	}
+}
+
+// WithMaxElapsedTime limits the total duration for retry attempts.
+func WithMaxElapsedTime(d time.Duration) RetryOption {
+	return func(args *retryOptions) {
+		args.MaxElapsedTime = d
+	}
+}
+
+// Retry attempts the operation until success, a permanent error, or backoff completion.
+// It ensures the operation is executed at least once.
+//
+// Returns the operation result or error if retries are exhausted or context is cancelled.
+func Retry[T any](ctx context.Context, operation Operation[T], opts ...RetryOption) (T, error) {
+	// Initialize default retry options.
+	args := &retryOptions{
+		BackOff:        NewExponentialBackOff(),
+		Timer:          &defaultTimer{},
+		MaxElapsedTime: DefaultMaxElapsedTime,
+	}
+
+	// Apply user-provided options to the default settings.
+	for _, opt := range opts {
+		opt(args)
+	}
+
+	defer args.Timer.Stop()
+
+	startedAt := time.Now()
+	args.BackOff.Reset()
+	for numTries := uint(1); ; numTries++ {
+		// Execute the operation.
+		res, err := operation()
+		if err == nil {
+			return res, nil
+		}
+
+		// Stop retrying if maximum tries exceeded.
+		if args.MaxTries > 0 && numTries >= args.MaxTries {
+			return res, err
+		}
+
+		// Handle permanent errors without retrying.
+		var permanent *PermanentError
+		if errors.As(err, &permanent) {
+			return res, permanent.Unwrap()
+		}
+
+		// Stop retrying if context is cancelled.
+		if cerr := context.Cause(ctx); cerr != nil {
+			return res, cerr
+		}
+
+		// Calculate next backoff duration.
+		next := args.BackOff.NextBackOff()
+		if next == Stop {
+			return res, err
+		}
+
+		// Reset backoff if RetryAfterError is encountered.
+		var retryAfter *RetryAfterError
+		if errors.As(err, &retryAfter) {
+			next = retryAfter.Duration
+			args.BackOff.Reset()
+		}
+
+		// Stop retrying if maximum elapsed time exceeded.
+		if args.MaxElapsedTime > 0 && time.Since(startedAt)+next > args.MaxElapsedTime {
+			return res, err
+		}
+
+		// Notify on error if a notifier function is provided.
+		if args.Notify != nil {
+			args.Notify(err, next)
+		}
+
+		// Wait for the next backoff period or context cancellation.
+		args.Timer.Start(next)
+		select {
+		case <-args.Timer.C():
+		case <-ctx.Done():
+			return res, context.Cause(ctx)
+		}
+	}
+}

vendor/github.com/cenkalti/backoff/v5/ticker.go

@@ -1,7 +1,6 @@
 package backoff
 
 import (
-	"context"
 	"sync"
 	"time"
 )
@@ -14,8 +13,7 @@ type Ticker struct {
 	C        <-chan time.Time
 	c        chan time.Time
 	b        BackOff
-	ctx      context.Context
-	timer    Timer
+	timer    timer
 	stop     chan struct{}
 	stopOnce sync.Once
 }
@@ -27,22 +25,12 @@ type Ticker struct {
 // provided backoff policy (notably calling NextBackOff or Reset)
 // while the ticker is running.
 func NewTicker(b BackOff) *Ticker {
-	return NewTickerWithTimer(b, &defaultTimer{})
-}
-
-// NewTickerWithTimer returns a new Ticker with a custom timer.
-// A default timer that uses system timer is used when nil is passed.
-func NewTickerWithTimer(b BackOff, timer Timer) *Ticker {
-	if timer == nil {
-		timer = &defaultTimer{}
-	}
 	c := make(chan time.Time)
 	t := &Ticker{
 		C:     c,
 		c:     c,
 		b:     b,
-		ctx:   getContext(b),
-		timer: timer,
+		timer: &defaultTimer{},
 		stop:  make(chan struct{}),
 	}
 	t.b.Reset()
@@ -73,8 +61,6 @@ func (t *Ticker) run() {
 		case <-t.stop:
 			t.c = nil // Prevent future ticks from being sent to the channel.
 			return
-		case <-t.ctx.Done():
-			return
 		}
 	}
 }

vendor/github.com/cenkalti/backoff/v5/timer.go

@@ -2,7 +2,7 @@ package backoff
 
 import "time"
 
-type Timer interface {
+type timer interface {
 	Start(duration time.Duration)
 	Stop()
 	C() <-chan time.Time

vendor/github.com/charmbracelet/bubbletea/.gitattributes

@@ -0,0 +1 @@
+*.golden -text

vendor/github.com/charmbracelet/bubbletea/.gitignore

@@ -0,0 +1,23 @@
+.DS_Store
+.envrc
+
+examples/fullscreen/fullscreen
+examples/help/help
+examples/http/http
+examples/list-default/list-default
+examples/list-fancy/list-fancy
+examples/list-simple/list-simple
+examples/mouse/mouse
+examples/pager/pager
+examples/progress-download/color_vortex.blend
+examples/progress-download/progress-download
+examples/simple/simple
+examples/spinner/spinner
+examples/textinput/textinput
+examples/textinputs/textinputs
+examples/views/views
+tutorials/basics/basics
+tutorials/commands/commands
+.idea
+coverage.txt
+dist/

vendor/github.com/charmbracelet/bubbletea/.golangci.yml

@@ -0,0 +1,40 @@
+version: "2"
+run:
+  tests: false
+linters:
+  enable:
+    - bodyclose
+    - exhaustive
+    - goconst
+    - godot
+    - gomoddirectives
+    - goprintffuncname
+    - gosec
+    - misspell
+    - nakedret
+    - nestif
+    - nilerr
+    - noctx
+    - nolintlint
+    - prealloc
+    - revive
+    - rowserrcheck
+    - sqlclosecheck
+    - tparallel
+    - unconvert
+    - unparam
+    - whitespace
+    - wrapcheck
+  exclusions:
+    generated: lax
+    presets:
+      - common-false-positives
+issues:
+  max-issues-per-linter: 0
+  max-same-issues: 0
+formatters:
+  enable:
+    - gofumpt
+    - goimports
+  exclusions:
+    generated: lax

vendor/github.com/charmbracelet/bubbletea/.goreleaser.yml

@@ -0,0 +1,5 @@
+# yaml-language-server: $schema=https://goreleaser.com/static/schema-pro.json
+version: 2
+includes:
+  - from_url:
+      url: charmbracelet/meta/main/goreleaser-lib.yaml

vendor/github.com/charmbracelet/bubbletea/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2020-2023 Charmbracelet, Inc
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

vendor/github.com/charmbracelet/bubbletea/README.md

@@ -0,0 +1,400 @@
+# Bubble Tea
+
+<p>
+    <picture>
+      <source media="(prefers-color-scheme: light)" srcset="https://stuff.charm.sh/bubbletea/bubble-tea-v2-light.png" width="308">
+      <source media="(prefers-color-scheme: dark)" srcset="https://stuff.charm.sh/bubbletea/bubble-tea-v2-dark.png" width="312">
+      <img src="https://stuff.charm.sh/bubbletea/bubble-tea-v2-light.png" width="308" />
+    </picture>
+    <br>
+    <a href="https://github.com/charmbracelet/bubbletea/releases"><img src="https://img.shields.io/github/release/charmbracelet/bubbletea.svg" alt="Latest Release"></a>
+    <a href="https://pkg.go.dev/github.com/charmbracelet/bubbletea?tab=doc"><img src="https://godoc.org/github.com/charmbracelet/bubbletea?status.svg" alt="GoDoc"></a>
+    <a href="https://github.com/charmbracelet/bubbletea/actions"><img src="https://github.com/charmbracelet/bubbletea/actions/workflows/build.yml/badge.svg" alt="Build Status"></a>
+</p>
+
+The fun, functional and stateful way to build terminal apps. A Go framework
+based on [The Elm Architecture][elm]. Bubble Tea is well-suited for simple and
+complex terminal applications, either inline, full-window, or a mix of both.
+
+<p>
+    <img src="https://stuff.charm.sh/bubbletea/bubbletea-example.gif" width="100%" alt="Bubble Tea Example">
+</p>
+
+Bubble Tea is in use in production and includes a number of features and
+performance optimizations we’ve added along the way. Among those is
+a framerate-based renderer, mouse support, focus reporting and more.
+
+To get started, see the tutorial below, the [examples][examples], the
+[docs][docs], the [video tutorials][youtube] and some common [resources](#libraries-we-use-with-bubble-tea).
+
+[youtube]: https://charm.sh/yt
+
+## By the way
+
+Be sure to check out [Bubbles][bubbles], a library of common UI components for Bubble Tea.
+
+<p>
+    <a href="https://github.com/charmbracelet/bubbles"><img src="https://stuff.charm.sh/bubbles/bubbles-badge.png" width="174" alt="Bubbles Badge"></a>&nbsp;&nbsp;
+    <a href="https://github.com/charmbracelet/bubbles"><img src="https://stuff.charm.sh/bubbles-examples/textinput.gif" width="400" alt="Text Input Example from Bubbles"></a>
+</p>
+
+---
+
+## Tutorial
+
+Bubble Tea is based on the functional design paradigms of [The Elm
+Architecture][elm], which happens to work nicely with Go. It's a delightful way
+to build applications.
+
+This tutorial assumes you have a working knowledge of Go.
+
+By the way, the non-annotated source code for this program is available
+[on GitHub][tut-source].
+
+[elm]: https://guide.elm-lang.org/architecture/
+[tut-source]: https://github.com/charmbracelet/bubbletea/tree/main/tutorials/basics
+
+### Enough! Let's get to it.
+
+For this tutorial, we're making a shopping list.
+
+To start we'll define our package and import some libraries. Our only external
+import will be the Bubble Tea library, which we'll call `tea` for short.
+
+```go
+package main
+
+// These imports will be used later on the tutorial. If you save the file
+// now, Go might complain they are unused, but that's fine.
+// You may also need to run `go mod tidy` to download bubbletea and its
+// dependencies.
+import (
+    "fmt"
+    "os"
+
+    tea "github.com/charmbracelet/bubbletea"
+)
+```
+
+Bubble Tea programs are comprised of a **model** that describes the application
+state and three simple methods on that model:
+
+- **Init**, a function that returns an initial command for the application to run.
+- **Update**, a function that handles incoming events and updates the model accordingly.
+- **View**, a function that renders the UI based on the data in the model.
+
+### The Model
+
+So let's start by defining our model which will store our application's state.
+It can be any type, but a `struct` usually makes the most sense.
+
+```go
+type model struct {
+    choices  []string           // items on the to-do list
+    cursor   int                // which to-do list item our cursor is pointing at
+    selected map[int]struct{}   // which to-do items are selected
+}
+```
+
+### Initialization
+
+Next, we’ll define our application’s initial state. In this case, we’re defining
+a function to return our initial model, however, we could just as easily define
+the initial model as a variable elsewhere, too.
+
+```go
+func initialModel() model {
+	return model{
+		// Our to-do list is a grocery list
+		choices:  []string{"Buy carrots", "Buy celery", "Buy kohlrabi"},
+
+		// A map which indicates which choices are selected. We're using
+		// the  map like a mathematical set. The keys refer to the indexes
+		// of the `choices` slice, above.
+		selected: make(map[int]struct{}),
+	}
+}
+```
+
+Next, we define the `Init` method. `Init` can return a `Cmd` that could perform
+some initial I/O. For now, we don't need to do any I/O, so for the command,
+we'll just return `nil`, which translates to "no command."
+
+```go
+func (m model) Init() tea.Cmd {
+    // Just return `nil`, which means "no I/O right now, please."
+    return nil
+}
+```
+
+### The Update Method
+
+Next up is the update method. The update function is called when ”things
+happen.” Its job is to look at what has happened and return an updated model in
+response. It can also return a `Cmd` to make more things happen, but for now
+don't worry about that part.
+
+In our case, when a user presses the down arrow, `Update`’s job is to notice
+that the down arrow was pressed and move the cursor accordingly (or not).
+
+The “something happened” comes in the form of a `Msg`, which can be any type.
+Messages are the result of some I/O that took place, such as a keypress, timer
+tick, or a response from a server.
+
+We usually figure out which type of `Msg` we received with a type switch, but
+you could also use a type assertion.
+
+For now, we'll just deal with `tea.KeyMsg` messages, which are automatically
+sent to the update function when keys are pressed.
+
+```go
+func (m model) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
+    switch msg := msg.(type) {
+
+    // Is it a key press?
+    case tea.KeyMsg:
+
+        // Cool, what was the actual key pressed?
+        switch msg.String() {
+
+        // These keys should exit the program.
+        case "ctrl+c", "q":
+            return m, tea.Quit
+
+        // The "up" and "k" keys move the cursor up
+        case "up", "k":
+            if m.cursor > 0 {
+                m.cursor--
+            }
+
+        // The "down" and "j" keys move the cursor down
+        case "down", "j":
+            if m.cursor < len(m.choices)-1 {
+                m.cursor++
+            }
+
+        // The "enter" key and the spacebar (a literal space) toggle
+        // the selected state for the item that the cursor is pointing at.
+        case "enter", " ":
+            _, ok := m.selected[m.cursor]
+            if ok {
+                delete(m.selected, m.cursor)
+            } else {
+                m.selected[m.cursor] = struct{}{}
+            }
+        }
+    }
+
+    // Return the updated model to the Bubble Tea runtime for processing.
+    // Note that we're not returning a command.
+    return m, nil
+}
+```
+
+You may have noticed that <kbd>ctrl+c</kbd> and <kbd>q</kbd> above return
+a `tea.Quit` command with the model. That’s a special command which instructs
+the Bubble Tea runtime to quit, exiting the program.
+
+### The View Method
+
+At last, it’s time to render our UI. Of all the methods, the view is the
+simplest. We look at the model in its current state and use it to return
+a `string`. That string is our UI!
+
+Because the view describes the entire UI of your application, you don’t have to
+worry about redrawing logic and stuff like that. Bubble Tea takes care of it
+for you.
+
+```go
+func (m model) View() string {
+    // The header
+    s := "What should we buy at the market?\n\n"
+
+    // Iterate over our choices
+    for i, choice := range m.choices {
+
+        // Is the cursor pointing at this choice?
+        cursor := " " // no cursor
+        if m.cursor == i {
+            cursor = ">" // cursor!
+        }
+
+        // Is this choice selected?
+        checked := " " // not selected
+        if _, ok := m.selected[i]; ok {
+            checked = "x" // selected!
+        }
+
+        // Render the row
+        s += fmt.Sprintf("%s [%s] %s\n", cursor, checked, choice)
+    }
+
+    // The footer
+    s += "\nPress q to quit.\n"
+
+    // Send the UI for rendering
+    return s
+}
+```
+
+### All Together Now
+
+The last step is to simply run our program. We pass our initial model to
+`tea.NewProgram` and let it rip:
+
+```go
+func main() {
+    p := tea.NewProgram(initialModel())
+    if _, err := p.Run(); err != nil {
+        fmt.Printf("Alas, there's been an error: %v", err)
+        os.Exit(1)
+    }
+}
+```
+
+## What’s Next?
+
+This tutorial covers the basics of building an interactive terminal UI, but
+in the real world you'll also need to perform I/O. To learn about that have a
+look at the [Command Tutorial][cmd]. It's pretty simple.
+
+There are also several [Bubble Tea examples][examples] available and, of course,
+there are [Go Docs][docs].
+
+[cmd]: https://github.com/charmbracelet/bubbletea/tree/main/tutorials/commands/
+[examples]: https://github.com/charmbracelet/bubbletea/tree/main/examples
+[docs]: https://pkg.go.dev/github.com/charmbracelet/bubbletea?tab=doc
+
+## Debugging
+
+### Debugging with Delve
+
+Since Bubble Tea apps assume control of stdin and stdout, you’ll need to run
+delve in headless mode and then connect to it:
+
+```bash
+# Start the debugger
+$ dlv debug --headless --api-version=2 --listen=127.0.0.1:43000 .
+API server listening at: 127.0.0.1:43000
+
+# Connect to it from another terminal
+$ dlv connect 127.0.0.1:43000
+```
+
+If you do not explicitly supply the `--listen` flag, the port used will vary
+per run, so passing this in makes the debugger easier to use from a script
+or your IDE of choice.
+
+Additionally, we pass in `--api-version=2` because delve defaults to version 1
+for backwards compatibility reasons. However, delve recommends using version 2
+for all new development and some clients may no longer work with version 1.
+For more information, see the [Delve documentation](https://github.com/go-delve/delve/tree/master/Documentation/api).
+
+### Logging Stuff
+
+You can’t really log to stdout with Bubble Tea because your TUI is busy
+occupying that! You can, however, log to a file by including something like
+the following prior to starting your Bubble Tea program:
+
+```go
+if len(os.Getenv("DEBUG")) > 0 {
+	f, err := tea.LogToFile("debug.log", "debug")
+	if err != nil {
+		fmt.Println("fatal:", err)
+		os.Exit(1)
+	}
+	defer f.Close()
+}
+```
+
+To see what’s being logged in real time, run `tail -f debug.log` while you run
+your program in another window.
+
+## Libraries we use with Bubble Tea
+
+- [Bubbles][bubbles]: Common Bubble Tea components such as text inputs, viewports, spinners and so on
+- [Lip Gloss][lipgloss]: Style, format and layout tools for terminal applications
+- [Harmonica][harmonica]: A spring animation library for smooth, natural motion
+- [BubbleZone][bubblezone]: Easy mouse event tracking for Bubble Tea components
+- [ntcharts][ntcharts]: A terminal charting library built for Bubble Tea and [Lip Gloss][lipgloss]
+
+[bubbles]: https://github.com/charmbracelet/bubbles
+[lipgloss]: https://github.com/charmbracelet/lipgloss
+[harmonica]: https://github.com/charmbracelet/harmonica
+[bubblezone]: https://github.com/lrstanley/bubblezone
+[ntcharts]: https://github.com/NimbleMarkets/ntcharts
+
+## Bubble Tea in the Wild
+
+There are over [10,000 applications](https://github.com/charmbracelet/bubbletea/network/dependents) built with Bubble Tea! Here are a handful of ’em.
+
+### Staff favourites
+
+- [chezmoi](https://github.com/twpayne/chezmoi): securely manage your dotfiles across multiple machines
+- [circumflex](https://github.com/bensadeh/circumflex): read Hacker News in the terminal
+- [gh-dash](https://www.github.com/dlvhdr/gh-dash): a GitHub CLI extension for PRs and issues
+- [Tetrigo](https://github.com/Broderick-Westrope/tetrigo): Tetris in the terminal
+- [Signls](https://github.com/emprcl/signls): a generative midi sequencer designed for composition and live performance
+- [Superfile](https://github.com/yorukot/superfile): a super file manager
+
+### In Industry
+
+- Microsoft Azure – [Aztify](https://github.com/Azure/aztfy): bring Microsoft Azure resources under Terraform
+- Daytona – [Daytona](https://github.com/daytonaio/daytona): open source dev environment manager
+- Cockroach Labs – [CockroachDB](https://github.com/cockroachdb/cockroach): a cloud-native, high-availability distributed SQL database
+- Truffle Security Co. – [Trufflehog](https://github.com/trufflesecurity/trufflehog): find leaked credentials
+- NVIDIA – [container-canary](https://github.com/NVIDIA/container-canary): a container validator
+- AWS – [eks-node-viewer](https://github.com/awslabs/eks-node-viewer): a tool for visualizing dynamic node usage within an EKS cluster
+- MinIO – [mc](https://github.com/minio/mc): the official [MinIO](https://min.io) client
+- Ubuntu – [Authd](https://github.com/ubuntu/authd): an authentication daemon for cloud-based identity providers
+
+### Charm stuff
+
+- [Glow](https://github.com/charmbracelet/glow): a markdown reader, browser, and online markdown stash
+- [Huh?](https://github.com/charmbracelet/huh): an interactive prompt and form toolkit
+- [Mods](https://github.com/charmbracelet/mods): AI on the CLI, built for pipelines
+- [Wishlist](https://github.com/charmbracelet/wishlist): an SSH directory (and bastion!)
+
+### There’s so much more where that came from
+
+For more applications built with Bubble Tea see [Charm & Friends][community].
+Is there something cool you made with Bubble Tea you want to share? [PRs][community] are
+welcome!
+
+## Contributing
+
+See [contributing][contribute].
+
+[contribute]: https://github.com/charmbracelet/bubbletea/contribute
+
+## Feedback
+
+We’d love to hear your thoughts on this project. Feel free to drop us a note!
+
+- [Twitter](https://twitter.com/charmcli)
+- [The Fediverse](https://mastodon.social/@charmcli)
+- [Discord](https://charm.sh/chat)
+
+## Acknowledgments
+
+Bubble Tea is based on the paradigms of [The Elm Architecture][elm] by Evan
+Czaplicki et alia and the excellent [go-tea][gotea] by TJ Holowaychuk. It’s
+inspired by the many great [_Zeichenorientierte Benutzerschnittstellen_][zb]
+of days past.
+
+[elm]: https://guide.elm-lang.org/architecture/
+[gotea]: https://github.com/tj/go-tea
+[zb]: https://de.wikipedia.org/wiki/Zeichenorientierte_Benutzerschnittstelle
+[community]: https://github.com/charm-and-friends/charm-in-the-wild
+
+## License
+
+[MIT](https://github.com/charmbracelet/bubbletea/raw/main/LICENSE)
+
+---
+
+Part of [Charm](https://charm.sh).
+
+<a href="https://charm.sh/"><img alt="The Charm logo" src="https://stuff.charm.sh/charm-badge.jpg" width="400"></a>
+
+Charm热爱开源 • Charm loves open source • نحنُ نحب المصادر المفتوحة

vendor/github.com/charmbracelet/bubbletea/Taskfile.yaml

@@ -0,0 +1,14 @@
+# https://taskfile.dev
+
+version: '3'
+
+tasks:
+  lint:
+    desc: Run lint
+    cmds:
+      - golangci-lint run
+
+  test:
+    desc: Run tests
+    cmds:
+      - go test ./... {{.CLI_ARGS}}

vendor/github.com/charmbracelet/bubbletea/commands.go

@@ -0,0 +1,216 @@
+package tea
+
+import (
+	"time"
+)
+
+// Batch performs a bunch of commands concurrently with no ordering guarantees
+// about the results. Use a Batch to return several commands.
+//
+// Example:
+//
+//	    func (m model) Init() Cmd {
+//		       return tea.Batch(someCommand, someOtherCommand)
+//	    }
+func Batch(cmds ...Cmd) Cmd {
+	var validCmds []Cmd //nolint:prealloc
+	for _, c := range cmds {
+		if c == nil {
+			continue
+		}
+		validCmds = append(validCmds, c)
+	}
+	switch len(validCmds) {
+	case 0:
+		return nil
+	case 1:
+		return validCmds[0]
+	default:
+		return func() Msg {
+			return BatchMsg(validCmds)
+		}
+	}
+}
+
+// BatchMsg is a message used to perform a bunch of commands concurrently with
+// no ordering guarantees. You can send a BatchMsg with Batch.
+type BatchMsg []Cmd
+
+// Sequence runs the given commands one at a time, in order. Contrast this with
+// Batch, which runs commands concurrently.
+func Sequence(cmds ...Cmd) Cmd {
+	return func() Msg {
+		return sequenceMsg(cmds)
+	}
+}
+
+// sequenceMsg is used internally to run the given commands in order.
+type sequenceMsg []Cmd
+
+// Every is a command that ticks in sync with the system clock. So, if you
+// wanted to tick with the system clock every second, minute or hour you
+// could use this. It's also handy for having different things tick in sync.
+//
+// Because we're ticking with the system clock the tick will likely not run for
+// the entire specified duration. For example, if we're ticking for one minute
+// and the clock is at 12:34:20 then the next tick will happen at 12:35:00, 40
+// seconds later.
+//
+// To produce the command, pass a duration and a function which returns
+// a message containing the time at which the tick occurred.
+//
+//	type TickMsg time.Time
+//
+//	cmd := Every(time.Second, func(t time.Time) Msg {
+//	   return TickMsg(t)
+//	})
+//
+// Beginners' note: Every sends a single message and won't automatically
+// dispatch messages at an interval. To do that, you'll want to return another
+// Every command after receiving your tick message. For example:
+//
+//	type TickMsg time.Time
+//
+//	// Send a message every second.
+//	func tickEvery() Cmd {
+//	    return Every(time.Second, func(t time.Time) Msg {
+//	        return TickMsg(t)
+//	    })
+//	}
+//
+//	func (m model) Init() Cmd {
+//	    // Start ticking.
+//	    return tickEvery()
+//	}
+//
+//	func (m model) Update(msg Msg) (Model, Cmd) {
+//	    switch msg.(type) {
+//	    case TickMsg:
+//	        // Return your Every command again to loop.
+//	        return m, tickEvery()
+//	    }
+//	    return m, nil
+//	}
+//
+// Every is analogous to Tick in the Elm Architecture.
+func Every(duration time.Duration, fn func(time.Time) Msg) Cmd {
+	n := time.Now()
+	d := n.Truncate(duration).Add(duration).Sub(n)
+	t := time.NewTimer(d)
+	return func() Msg {
+		ts := <-t.C
+		t.Stop()
+		for len(t.C) > 0 {
+			<-t.C
+		}
+		return fn(ts)
+	}
+}
+
+// Tick produces a command at an interval independent of the system clock at
+// the given duration. That is, the timer begins precisely when invoked,
+// and runs for its entire duration.
+//
+// To produce the command, pass a duration and a function which returns
+// a message containing the time at which the tick occurred.
+//
+//	type TickMsg time.Time
+//
+//	cmd := Tick(time.Second, func(t time.Time) Msg {
+//	   return TickMsg(t)
+//	})
+//
+// Beginners' note: Tick sends a single message and won't automatically
+// dispatch messages at an interval. To do that, you'll want to return another
+// Tick command after receiving your tick message. For example:
+//
+//	type TickMsg time.Time
+//
+//	func doTick() Cmd {
+//	    return Tick(time.Second, func(t time.Time) Msg {
+//	        return TickMsg(t)
+//	    })
+//	}
+//
+//	func (m model) Init() Cmd {
+//	    // Start ticking.
+//	    return doTick()
+//	}
+//
+//	func (m model) Update(msg Msg) (Model, Cmd) {
+//	    switch msg.(type) {
+//	    case TickMsg:
+//	        // Return your Tick command again to loop.
+//	        return m, doTick()
+//	    }
+//	    return m, nil
+//	}
+func Tick(d time.Duration, fn func(time.Time) Msg) Cmd {
+	t := time.NewTimer(d)
+	return func() Msg {
+		ts := <-t.C
+		t.Stop()
+		for len(t.C) > 0 {
+			<-t.C
+		}
+		return fn(ts)
+	}
+}
+
+// Sequentially produces a command that sequentially executes the given
+// commands.
+// The Msg returned is the first non-nil message returned by a Cmd.
+//
+//	func saveStateCmd() Msg {
+//	   if err := save(); err != nil {
+//	       return errMsg{err}
+//	   }
+//	   return nil
+//	}
+//
+//	cmd := Sequentially(saveStateCmd, Quit)
+//
+// Deprecated: use Sequence instead.
+func Sequentially(cmds ...Cmd) Cmd {
+	return func() Msg {
+		for _, cmd := range cmds {
+			if cmd == nil {
+				continue
+			}
+			if msg := cmd(); msg != nil {
+				return msg
+			}
+		}
+		return nil
+	}
+}
+
+// setWindowTitleMsg is an internal message used to set the window title.
+type setWindowTitleMsg string
+
+// SetWindowTitle produces a command that sets the terminal title.
+//
+// For example:
+//
+//	func (m model) Init() Cmd {
+//	    // Set title.
+//	    return tea.SetWindowTitle("My App")
+//	}
+func SetWindowTitle(title string) Cmd {
+	return func() Msg {
+		return setWindowTitleMsg(title)
+	}
+}
+
+type windowSizeMsg struct{}
+
+// WindowSize is a command that queries the terminal for its current size. It
+// delivers the results to Update via a [WindowSizeMsg]. Keep in mind that
+// WindowSizeMsgs will automatically be delivered to Update when the [Program]
+// starts and when the window dimensions change so in many cases you will not
+// need to explicitly invoke this command.
+func WindowSize() Cmd {
+	return func() Msg {
+		return windowSizeMsg{}
+	}
+}

vendor/github.com/charmbracelet/bubbletea/exec.go

@@ -0,0 +1,133 @@
+package tea
+
+import (
+	"io"
+	"os"
+	"os/exec"
+)
+
+// execMsg is used internally to run an ExecCommand sent with Exec.
+type execMsg struct {
+	cmd ExecCommand
+	fn  ExecCallback
+}
+
+// Exec is used to perform arbitrary I/O in a blocking fashion, effectively
+// pausing the Program while execution is running and resuming it when
+// execution has completed.
+//
+// Most of the time you'll want to use ExecProcess, which runs an exec.Cmd.
+//
+// For non-interactive i/o you should use a Cmd (that is, a tea.Cmd).
+func Exec(c ExecCommand, fn ExecCallback) Cmd {
+	return func() Msg {
+		return execMsg{cmd: c, fn: fn}
+	}
+}
+
+// ExecProcess runs the given *exec.Cmd in a blocking fashion, effectively
+// pausing the Program while the command is running. After the *exec.Cmd exists
+// the Program resumes. It's useful for spawning other interactive applications
+// such as editors and shells from within a Program.
+//
+// To produce the command, pass an *exec.Cmd and a function which returns
+// a message containing the error which may have occurred when running the
+// ExecCommand.
+//
+//	type VimFinishedMsg struct { err error }
+//
+//	c := exec.Command("vim", "file.txt")
+//
+//	cmd := ExecProcess(c, func(err error) Msg {
+//	    return VimFinishedMsg{err: err}
+//	})
+//
+// Or, if you don't care about errors, you could simply:
+//
+//	cmd := ExecProcess(exec.Command("vim", "file.txt"), nil)
+//
+// For non-interactive i/o you should use a Cmd (that is, a tea.Cmd).
+func ExecProcess(c *exec.Cmd, fn ExecCallback) Cmd {
+	return Exec(wrapExecCommand(c), fn)
+}
+
+// ExecCallback is used when executing an *exec.Command to return a message
+// with an error, which may or may not be nil.
+type ExecCallback func(error) Msg
+
+// ExecCommand can be implemented to execute things in a blocking fashion in
+// the current terminal.
+type ExecCommand interface {
+	Run() error
+	SetStdin(io.Reader)
+	SetStdout(io.Writer)
+	SetStderr(io.Writer)
+}
+
+// wrapExecCommand wraps an exec.Cmd so that it satisfies the ExecCommand
+// interface so it can be used with Exec.
+func wrapExecCommand(c *exec.Cmd) ExecCommand {
+	return &osExecCommand{Cmd: c}
+}
+
+// osExecCommand is a layer over an exec.Cmd that satisfies the ExecCommand
+// interface.
+type osExecCommand struct{ *exec.Cmd }
+
+// SetStdin sets stdin on underlying exec.Cmd to the given io.Reader.
+func (c *osExecCommand) SetStdin(r io.Reader) {
+	// If unset, have the command use the same input as the terminal.
+	if c.Stdin == nil {
+		c.Stdin = r
+	}
+}
+
+// SetStdout sets stdout on underlying exec.Cmd to the given io.Writer.
+func (c *osExecCommand) SetStdout(w io.Writer) {
+	// If unset, have the command use the same output as the terminal.
+	if c.Stdout == nil {
+		c.Stdout = w
+	}
+}
+
+// SetStderr sets stderr on the underlying exec.Cmd to the given io.Writer.
+func (c *osExecCommand) SetStderr(w io.Writer) {
+	// If unset, use stderr for the command's stderr
+	if c.Stderr == nil {
+		c.Stderr = w
+	}
+}
+
+// exec runs an ExecCommand and delivers the results to the program as a Msg.
+func (p *Program) exec(c ExecCommand, fn ExecCallback) {
+	if err := p.ReleaseTerminal(); err != nil {
+		// If we can't release input, abort.
+		if fn != nil {
+			go p.Send(fn(err))
+		}
+		return
+	}
+
+	c.SetStdin(p.input)
+	c.SetStdout(p.output)
+	c.SetStderr(os.Stderr)
+
+	// Execute system command.
+	if err := c.Run(); err != nil {
+		p.renderer.resetLinesRendered()
+		_ = p.RestoreTerminal() // also try to restore the terminal.
+		if fn != nil {
+			go p.Send(fn(err))
+		}
+		return
+	}
+
+	// Maintain the existing output from the command
+	p.renderer.resetLinesRendered()
+
+	// Have the program re-capture input.
+	err := p.RestoreTerminal()
+	if fn != nil {
+		go p.Send(fn(err))
+	}
+}

vendor/github.com/charmbracelet/bubbletea/focus.go

@@ -0,0 +1,9 @@
+package tea
+
+// FocusMsg represents a terminal focus message.
+// This occurs when the terminal gains focus.
+type FocusMsg struct{}
+
+// BlurMsg represents a terminal blur message.
+// This occurs when the terminal loses focus.
+type BlurMsg struct{}

vendor/github.com/charmbracelet/bubbletea/inputreader_other.go

@@ -0,0 +1,19 @@
+//go:build !windows
+// +build !windows
+
+package tea
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/muesli/cancelreader"
+)
+
+func newInputReader(r io.Reader, _ bool) (cancelreader.CancelReader, error) {
+	cr, err := cancelreader.NewReader(r)
+	if err != nil {
+		return nil, fmt.Errorf("bubbletea: error creating cancel reader: %w", err)
+	}
+	return cr, nil
+}

vendor/github.com/charmbracelet/bubbletea/inputreader_windows.go

@@ -0,0 +1,129 @@
+//go:build windows
+// +build windows
+
+package tea
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"sync"
+
+	"github.com/charmbracelet/x/term"
+	"github.com/erikgeiser/coninput"
+	"github.com/muesli/cancelreader"
+	"golang.org/x/sys/windows"
+)
+
+type conInputReader struct {
+	cancelMixin
+
+	conin windows.Handle
+
+	originalMode uint32
+}
+
+var _ cancelreader.CancelReader = &conInputReader{}
+
+func newInputReader(r io.Reader, enableMouse bool) (cancelreader.CancelReader, error) {
+	fallback := func(io.Reader) (cancelreader.CancelReader, error) {
+		return cancelreader.NewReader(r)
+	}
+	if f, ok := r.(term.File); !ok || f.Fd() != os.Stdin.Fd() {
+		return fallback(r)
+	}
+
+	conin, err := coninput.NewStdinHandle()
+	if err != nil {
+		return fallback(r)
+	}
+
+	modes := []uint32{
+		windows.ENABLE_WINDOW_INPUT,
+		windows.ENABLE_EXTENDED_FLAGS,
+	}
+
+	// Since we have options to enable mouse events, [WithMouseCellMotion],
+	// [WithMouseAllMotion], and [EnableMouseCellMotion],
+	// [EnableMouseAllMotion], and [DisableMouse], we need to check if the user
+	// has enabled mouse events and add the appropriate mode accordingly.
+	// Otherwise, mouse events will be enabled all the time.
+	if enableMouse {
+		modes = append(modes, windows.ENABLE_MOUSE_INPUT)
+	}
+
+	originalMode, err := prepareConsole(conin, modes...)
+	if err != nil {
+		return nil, fmt.Errorf("failed to prepare console input: %w", err)
+	}
+
+	return &conInputReader{
+		conin:        conin,
+		originalMode: originalMode,
+	}, nil
+}
+
+// Cancel implements cancelreader.CancelReader.
+func (r *conInputReader) Cancel() bool {
+	r.setCanceled()
+
+	// Warning: These cancel methods do not reliably work on console input
+	// 			and should not be counted on.
+	return windows.CancelIoEx(r.conin, nil) == nil || windows.CancelIo(r.conin) == nil
+}
+
+// Close implements cancelreader.CancelReader.
+func (r *conInputReader) Close() error {
+	if r.originalMode != 0 {
+		err := windows.SetConsoleMode(r.conin, r.originalMode)
+		if err != nil {
+			return fmt.Errorf("reset console mode: %w", err)
+		}
+	}
+
+	return nil
+}
+
+// Read implements cancelreader.CancelReader.
+func (r *conInputReader) Read(_ []byte) (n int, err error) {
+	if r.isCanceled() {
+		err = cancelreader.ErrCanceled
+	}
+	return
+}
+
+func prepareConsole(input windows.Handle, modes ...uint32) (originalMode uint32, err error) {
+	err = windows.GetConsoleMode(input, &originalMode)
+	if err != nil {
+		return 0, fmt.Errorf("get console mode: %w", err)
+	}
+
+	newMode := coninput.AddInputModes(0, modes...)
+
+	err = windows.SetConsoleMode(input, newMode)
+	if err != nil {
+		return 0, fmt.Errorf("set console mode: %w", err)
+	}
+
+	return originalMode, nil
+}
+
+// cancelMixin represents a goroutine-safe cancelation status.
+type cancelMixin struct {
+	unsafeCanceled bool
+	lock           sync.Mutex
+}
+
+func (c *cancelMixin) setCanceled() {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+
+	c.unsafeCanceled = true
+}
+
+func (c *cancelMixin) isCanceled() bool {
+	c.lock.Lock()
+	defer c.lock.Unlock()
+
+	return c.unsafeCanceled
+}

vendor/github.com/charmbracelet/bubbletea/key.go

@@ -0,0 +1,715 @@
+package tea
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"regexp"
+	"strings"
+	"unicode/utf8"
+)
+
+// KeyMsg contains information about a keypress. KeyMsgs are always sent to
+// the program's update function. There are a couple general patterns you could
+// use to check for keypresses:
+//
+//	// Switch on the string representation of the key (shorter)
+//	switch msg := msg.(type) {
+//	case KeyMsg:
+//	    switch msg.String() {
+//	    case "enter":
+//	        fmt.Println("you pressed enter!")
+//	    case "a":
+//	        fmt.Println("you pressed a!")
+//	    }
+//	}
+//
+//	// Switch on the key type (more foolproof)
+//	switch msg := msg.(type) {
+//	case KeyMsg:
+//	    switch msg.Type {
+//	    case KeyEnter:
+//	        fmt.Println("you pressed enter!")
+//	    case KeyRunes:
+//	        switch string(msg.Runes) {
+//	        case "a":
+//	            fmt.Println("you pressed a!")
+//	        }
+//	    }
+//	}
+//
+// Note that Key.Runes will always contain at least one character, so you can
+// always safely call Key.Runes[0]. In most cases Key.Runes will only contain
+// one character, though certain input method editors (most notably Chinese
+// IMEs) can input multiple runes at once.
+type KeyMsg Key
+
+// String returns a string representation for a key message. It's safe (and
+// encouraged) for use in key comparison.
+func (k KeyMsg) String() (str string) {
+	return Key(k).String()
+}
+
+// Key contains information about a keypress.
+type Key struct {
+	Type  KeyType
+	Runes []rune
+	Alt   bool
+	Paste bool
+}
+
+// String returns a friendly string representation for a key. It's safe (and
+// encouraged) for use in key comparison.
+//
+//	k := Key{Type: KeyEnter}
+//	fmt.Println(k)
+//	// Output: enter
+func (k Key) String() (str string) {
+	var buf strings.Builder
+	if k.Alt {
+		buf.WriteString("alt+")
+	}
+	if k.Type == KeyRunes {
+		if k.Paste {
+			// Note: bubbles/keys bindings currently do string compares to
+			// recognize shortcuts. Since pasted text should never activate
+			// shortcuts, we need to ensure that the binding code doesn't
+			// match Key events that result from pastes. We achieve this
+			// here by enclosing pastes in '[...]' so that the string
+			// comparison in Matches() fails in that case.
+			buf.WriteByte('[')
+		}
+		buf.WriteString(string(k.Runes))
+		if k.Paste {
+			buf.WriteByte(']')
+		}
+		return buf.String()
+	} else if s, ok := keyNames[k.Type]; ok {
+		buf.WriteString(s)
+		return buf.String()
+	}
+	return ""
+}
+
+// KeyType indicates the key pressed, such as KeyEnter or KeyBreak or KeyCtrlC.
+// All other keys will be type KeyRunes. To get the rune value, check the Rune
+// method on a Key struct, or use the Key.String() method:
+//
+//	k := Key{Type: KeyRunes, Runes: []rune{'a'}, Alt: true}
+//	if k.Type == KeyRunes {
+//
+//	    fmt.Println(k.Runes)
+//	    // Output: a
+//
+//	    fmt.Println(k.String())
+//	    // Output: alt+a
+//
+//	}
+type KeyType int
+
+func (k KeyType) String() (str string) {
+	if s, ok := keyNames[k]; ok {
+		return s
+	}
+	return ""
+}
+
+// Control keys. We could do this with an iota, but the values are very
+// specific, so we set the values explicitly to avoid any confusion.
+//
+// See also:
+// https://en.wikipedia.org/wiki/C0_and_C1_control_codes
+const (
+	keyNUL KeyType = 0   // null, \0
+	keySOH KeyType = 1   // start of heading
+	keySTX KeyType = 2   // start of text
+	keyETX KeyType = 3   // break, ctrl+c
+	keyEOT KeyType = 4   // end of transmission
+	keyENQ KeyType = 5   // enquiry
+	keyACK KeyType = 6   // acknowledge
+	keyBEL KeyType = 7   // bell, \a
+	keyBS  KeyType = 8   // backspace
+	keyHT  KeyType = 9   // horizontal tabulation, \t
+	keyLF  KeyType = 10  // line feed, \n
+	keyVT  KeyType = 11  // vertical tabulation \v
+	keyFF  KeyType = 12  // form feed \f
+	keyCR  KeyType = 13  // carriage return, \r
+	keySO  KeyType = 14  // shift out
+	keySI  KeyType = 15  // shift in
+	keyDLE KeyType = 16  // data link escape
+	keyDC1 KeyType = 17  // device control one
+	keyDC2 KeyType = 18  // device control two
+	keyDC3 KeyType = 19  // device control three
+	keyDC4 KeyType = 20  // device control four
+	keyNAK KeyType = 21  // negative acknowledge
+	keySYN KeyType = 22  // synchronous idle
+	keyETB KeyType = 23  // end of transmission block
+	keyCAN KeyType = 24  // cancel
+	keyEM  KeyType = 25  // end of medium
+	keySUB KeyType = 26  // substitution
+	keyESC KeyType = 27  // escape, \e
+	keyFS  KeyType = 28  // file separator
+	keyGS  KeyType = 29  // group separator
+	keyRS  KeyType = 30  // record separator
+	keyUS  KeyType = 31  // unit separator
+	keyDEL KeyType = 127 // delete. on most systems this is mapped to backspace, I hear
+)
+
+// Control key aliases.
+const (
+	KeyNull      KeyType = keyNUL
+	KeyBreak     KeyType = keyETX
+	KeyEnter     KeyType = keyCR
+	KeyBackspace KeyType = keyDEL
+	KeyTab       KeyType = keyHT
+	KeyEsc       KeyType = keyESC
+	KeyEscape    KeyType = keyESC
+
+	KeyCtrlAt           KeyType = keyNUL // ctrl+@
+	KeyCtrlA            KeyType = keySOH
+	KeyCtrlB            KeyType = keySTX
+	KeyCtrlC            KeyType = keyETX
+	KeyCtrlD            KeyType = keyEOT
+	KeyCtrlE            KeyType = keyENQ
+	KeyCtrlF            KeyType = keyACK
+	KeyCtrlG            KeyType = keyBEL
+	KeyCtrlH            KeyType = keyBS
+	KeyCtrlI            KeyType = keyHT
+	KeyCtrlJ            KeyType = keyLF
+	KeyCtrlK            KeyType = keyVT
+	KeyCtrlL            KeyType = keyFF
+	KeyCtrlM            KeyType = keyCR
+	KeyCtrlN            KeyType = keySO
+	KeyCtrlO            KeyType = keySI
+	KeyCtrlP            KeyType = keyDLE
+	KeyCtrlQ            KeyType = keyDC1
+	KeyCtrlR            KeyType = keyDC2
+	KeyCtrlS            KeyType = keyDC3
+	KeyCtrlT            KeyType = keyDC4
+	KeyCtrlU            KeyType = keyNAK
+	KeyCtrlV            KeyType = keySYN
+	KeyCtrlW            KeyType = keyETB
+	KeyCtrlX            KeyType = keyCAN
+	KeyCtrlY            KeyType = keyEM
+	KeyCtrlZ            KeyType = keySUB
+	KeyCtrlOpenBracket  KeyType = keyESC // ctrl+[
+	KeyCtrlBackslash    KeyType = keyFS  // ctrl+\
+	KeyCtrlCloseBracket KeyType = keyGS  // ctrl+]
+	KeyCtrlCaret        KeyType = keyRS  // ctrl+^
+	KeyCtrlUnderscore   KeyType = keyUS  // ctrl+_
+	KeyCtrlQuestionMark KeyType = keyDEL // ctrl+?
+)
+
+// Other keys.
+const (
+	KeyRunes KeyType = -(iota + 1)
+	KeyUp
+	KeyDown
+	KeyRight
+	KeyLeft
+	KeyShiftTab
+	KeyHome
+	KeyEnd
+	KeyPgUp
+	KeyPgDown
+	KeyCtrlPgUp
+	KeyCtrlPgDown
+	KeyDelete
+	KeyInsert
+	KeySpace
+	KeyCtrlUp
+	KeyCtrlDown
+	KeyCtrlRight
+	KeyCtrlLeft
+	KeyCtrlHome
+	KeyCtrlEnd
+	KeyShiftUp
+	KeyShiftDown
+	KeyShiftRight
+	KeyShiftLeft
+	KeyShiftHome
+	KeyShiftEnd
+	KeyCtrlShiftUp
+	KeyCtrlShiftDown
+	KeyCtrlShiftLeft
+	KeyCtrlShiftRight
+	KeyCtrlShiftHome
+	KeyCtrlShiftEnd
+	KeyF1
+	KeyF2
+	KeyF3
+	KeyF4
+	KeyF5
+	KeyF6
+	KeyF7
+	KeyF8
+	KeyF9
+	KeyF10
+	KeyF11
+	KeyF12
+	KeyF13
+	KeyF14
+	KeyF15
+	KeyF16
+	KeyF17
+	KeyF18
+	KeyF19
+	KeyF20
+)
+
+// Mappings for control keys and other special keys to friendly consts.
+var keyNames = map[KeyType]string{
+	// Control keys.
+	keyNUL: "ctrl+@", // also ctrl+` (that's ctrl+backtick)
+	keySOH: "ctrl+a",
+	keySTX: "ctrl+b",
+	keyETX: "ctrl+c",
+	keyEOT: "ctrl+d",
+	keyENQ: "ctrl+e",
+	keyACK: "ctrl+f",
+	keyBEL: "ctrl+g",
+	keyBS:  "ctrl+h",
+	keyHT:  "tab", // also ctrl+i
+	keyLF:  "ctrl+j",
+	keyVT:  "ctrl+k",
+	keyFF:  "ctrl+l",
+	keyCR:  "enter",
+	keySO:  "ctrl+n",
+	keySI:  "ctrl+o",
+	keyDLE: "ctrl+p",
+	keyDC1: "ctrl+q",
+	keyDC2: "ctrl+r",
+	keyDC3: "ctrl+s",
+	keyDC4: "ctrl+t",
+	keyNAK: "ctrl+u",
+	keySYN: "ctrl+v",
+	keyETB: "ctrl+w",
+	keyCAN: "ctrl+x",
+	keyEM:  "ctrl+y",
+	keySUB: "ctrl+z",
+	keyESC: "esc",
+	keyFS:  "ctrl+\\",
+	keyGS:  "ctrl+]",
+	keyRS:  "ctrl+^",
+	keyUS:  "ctrl+_",
+	keyDEL: "backspace",
+
+	// Other keys.
+	KeyRunes:          "runes",
+	KeyUp:             "up",
+	KeyDown:           "down",
+	KeyRight:          "right",
+	KeySpace:          " ", // for backwards compatibility
+	KeyLeft:           "left",
+	KeyShiftTab:       "shift+tab",
+	KeyHome:           "home",
+	KeyEnd:            "end",
+	KeyCtrlHome:       "ctrl+home",
+	KeyCtrlEnd:        "ctrl+end",
+	KeyShiftHome:      "shift+home",
+	KeyShiftEnd:       "shift+end",
+	KeyCtrlShiftHome:  "ctrl+shift+home",
+	KeyCtrlShiftEnd:   "ctrl+shift+end",
+	KeyPgUp:           "pgup",
+	KeyPgDown:         "pgdown",
+	KeyCtrlPgUp:       "ctrl+pgup",
+	KeyCtrlPgDown:     "ctrl+pgdown",
+	KeyDelete:         "delete",
+	KeyInsert:         "insert",
+	KeyCtrlUp:         "ctrl+up",
+	KeyCtrlDown:       "ctrl+down",
+	KeyCtrlRight:      "ctrl+right",
+	KeyCtrlLeft:       "ctrl+left",
+	KeyShiftUp:        "shift+up",
+	KeyShiftDown:      "shift+down",
+	KeyShiftRight:     "shift+right",
+	KeyShiftLeft:      "shift+left",
+	KeyCtrlShiftUp:    "ctrl+shift+up",
+	KeyCtrlShiftDown:  "ctrl+shift+down",
+	KeyCtrlShiftLeft:  "ctrl+shift+left",
+	KeyCtrlShiftRight: "ctrl+shift+right",
+	KeyF1:             "f1",
+	KeyF2:             "f2",
+	KeyF3:             "f3",
+	KeyF4:             "f4",
+	KeyF5:             "f5",
+	KeyF6:             "f6",
+	KeyF7:             "f7",
+	KeyF8:             "f8",
+	KeyF9:             "f9",
+	KeyF10:            "f10",
+	KeyF11:            "f11",
+	KeyF12:            "f12",
+	KeyF13:            "f13",
+	KeyF14:            "f14",
+	KeyF15:            "f15",
+	KeyF16:            "f16",
+	KeyF17:            "f17",
+	KeyF18:            "f18",
+	KeyF19:            "f19",
+	KeyF20:            "f20",
+}
+
+// Sequence mappings.
+var sequences = map[string]Key{
+	// Arrow keys
+	"\x1b[A":    {Type: KeyUp},
+	"\x1b[B":    {Type: KeyDown},
+	"\x1b[C":    {Type: KeyRight},
+	"\x1b[D":    {Type: KeyLeft},
+	"\x1b[1;2A": {Type: KeyShiftUp},
+	"\x1b[1;2B": {Type: KeyShiftDown},
+	"\x1b[1;2C": {Type: KeyShiftRight},
+	"\x1b[1;2D": {Type: KeyShiftLeft},
+	"\x1b[OA":   {Type: KeyShiftUp},    // DECCKM
+	"\x1b[OB":   {Type: KeyShiftDown},  // DECCKM
+	"\x1b[OC":   {Type: KeyShiftRight}, // DECCKM
+	"\x1b[OD":   {Type: KeyShiftLeft},  // DECCKM
+	"\x1b[a":    {Type: KeyShiftUp},    // urxvt
+	"\x1b[b":    {Type: KeyShiftDown},  // urxvt
+	"\x1b[c":    {Type: KeyShiftRight}, // urxvt
+	"\x1b[d":    {Type: KeyShiftLeft},  // urxvt
+	"\x1b[1;3A": {Type: KeyUp, Alt: true},
+	"\x1b[1;3B": {Type: KeyDown, Alt: true},
+	"\x1b[1;3C": {Type: KeyRight, Alt: true},
+	"\x1b[1;3D": {Type: KeyLeft, Alt: true},
+
+	"\x1b[1;4A": {Type: KeyShiftUp, Alt: true},
+	"\x1b[1;4B": {Type: KeyShiftDown, Alt: true},
+	"\x1b[1;4C": {Type: KeyShiftRight, Alt: true},
+	"\x1b[1;4D": {Type: KeyShiftLeft, Alt: true},
+
+	"\x1b[1;5A": {Type: KeyCtrlUp},
+	"\x1b[1;5B": {Type: KeyCtrlDown},
+	"\x1b[1;5C": {Type: KeyCtrlRight},
+	"\x1b[1;5D": {Type: KeyCtrlLeft},
+	"\x1b[Oa":   {Type: KeyCtrlUp, Alt: true},    // urxvt
+	"\x1b[Ob":   {Type: KeyCtrlDown, Alt: true},  // urxvt
+	"\x1b[Oc":   {Type: KeyCtrlRight, Alt: true}, // urxvt
+	"\x1b[Od":   {Type: KeyCtrlLeft, Alt: true},  // urxvt
+	"\x1b[1;6A": {Type: KeyCtrlShiftUp},
+	"\x1b[1;6B": {Type: KeyCtrlShiftDown},
+	"\x1b[1;6C": {Type: KeyCtrlShiftRight},
+	"\x1b[1;6D": {Type: KeyCtrlShiftLeft},
+	"\x1b[1;7A": {Type: KeyCtrlUp, Alt: true},
+	"\x1b[1;7B": {Type: KeyCtrlDown, Alt: true},
+	"\x1b[1;7C": {Type: KeyCtrlRight, Alt: true},
+	"\x1b[1;7D": {Type: KeyCtrlLeft, Alt: true},
+	"\x1b[1;8A": {Type: KeyCtrlShiftUp, Alt: true},
+	"\x1b[1;8B": {Type: KeyCtrlShiftDown, Alt: true},
+	"\x1b[1;8C": {Type: KeyCtrlShiftRight, Alt: true},
+	"\x1b[1;8D": {Type: KeyCtrlShiftLeft, Alt: true},
+
+	// Miscellaneous keys
+	"\x1b[Z": {Type: KeyShiftTab},
+
+	"\x1b[2~":   {Type: KeyInsert},
+	"\x1b[3;2~": {Type: KeyInsert, Alt: true},
+
+	"\x1b[3~":   {Type: KeyDelete},
+	"\x1b[3;3~": {Type: KeyDelete, Alt: true},
+
+	"\x1b[5~":   {Type: KeyPgUp},
+	"\x1b[5;3~": {Type: KeyPgUp, Alt: true},
+	"\x1b[5;5~": {Type: KeyCtrlPgUp},
+	"\x1b[5^":   {Type: KeyCtrlPgUp}, // urxvt
+	"\x1b[5;7~": {Type: KeyCtrlPgUp, Alt: true},
+
+	"\x1b[6~":   {Type: KeyPgDown},
+	"\x1b[6;3~": {Type: KeyPgDown, Alt: true},
+	"\x1b[6;5~": {Type: KeyCtrlPgDown},
+	"\x1b[6^":   {Type: KeyCtrlPgDown}, // urxvt
+	"\x1b[6;7~": {Type: KeyCtrlPgDown, Alt: true},
+
+	"\x1b[1~":   {Type: KeyHome},
+	"\x1b[H":    {Type: KeyHome},                     // xterm, lxterm
+	"\x1b[1;3H": {Type: KeyHome, Alt: true},          // xterm, lxterm
+	"\x1b[1;5H": {Type: KeyCtrlHome},                 // xterm, lxterm
+	"\x1b[1;7H": {Type: KeyCtrlHome, Alt: true},      // xterm, lxterm
+	"\x1b[1;2H": {Type: KeyShiftHome},                // xterm, lxterm
+	"\x1b[1;4H": {Type: KeyShiftHome, Alt: true},     // xterm, lxterm
+	"\x1b[1;6H": {Type: KeyCtrlShiftHome},            // xterm, lxterm
+	"\x1b[1;8H": {Type: KeyCtrlShiftHome, Alt: true}, // xterm, lxterm
+
+	"\x1b[4~":   {Type: KeyEnd},
+	"\x1b[F":    {Type: KeyEnd},                     // xterm, lxterm
+	"\x1b[1;3F": {Type: KeyEnd, Alt: true},          // xterm, lxterm
+	"\x1b[1;5F": {Type: KeyCtrlEnd},                 // xterm, lxterm
+	"\x1b[1;7F": {Type: KeyCtrlEnd, Alt: true},      // xterm, lxterm
+	"\x1b[1;2F": {Type: KeyShiftEnd},                // xterm, lxterm
+	"\x1b[1;4F": {Type: KeyShiftEnd, Alt: true},     // xterm, lxterm
+	"\x1b[1;6F": {Type: KeyCtrlShiftEnd},            // xterm, lxterm
+	"\x1b[1;8F": {Type: KeyCtrlShiftEnd, Alt: true}, // xterm, lxterm
+
+	"\x1b[7~": {Type: KeyHome},          // urxvt
+	"\x1b[7^": {Type: KeyCtrlHome},      // urxvt
+	"\x1b[7$": {Type: KeyShiftHome},     // urxvt
+	"\x1b[7@": {Type: KeyCtrlShiftHome}, // urxvt
+
+	"\x1b[8~": {Type: KeyEnd},          // urxvt
+	"\x1b[8^": {Type: KeyCtrlEnd},      // urxvt
+	"\x1b[8$": {Type: KeyShiftEnd},     // urxvt
+	"\x1b[8@": {Type: KeyCtrlShiftEnd}, // urxvt
+
+	// Function keys, Linux console
+	"\x1b[[A": {Type: KeyF1}, // linux console
+	"\x1b[[B": {Type: KeyF2}, // linux console
+	"\x1b[[C": {Type: KeyF3}, // linux console
+	"\x1b[[D": {Type: KeyF4}, // linux console
+	"\x1b[[E": {Type: KeyF5}, // linux console
+
+	// Function keys, X11
+	"\x1bOP": {Type: KeyF1}, // vt100, xterm
+	"\x1bOQ": {Type: KeyF2}, // vt100, xterm
+	"\x1bOR": {Type: KeyF3}, // vt100, xterm
+	"\x1bOS": {Type: KeyF4}, // vt100, xterm
+
+	"\x1b[1;3P": {Type: KeyF1, Alt: true}, // vt100, xterm
+	"\x1b[1;3Q": {Type: KeyF2, Alt: true}, // vt100, xterm
+	"\x1b[1;3R": {Type: KeyF3, Alt: true}, // vt100, xterm
+	"\x1b[1;3S": {Type: KeyF4, Alt: true}, // vt100, xterm
+
+	"\x1b[11~": {Type: KeyF1}, // urxvt
+	"\x1b[12~": {Type: KeyF2}, // urxvt
+	"\x1b[13~": {Type: KeyF3}, // urxvt
+	"\x1b[14~": {Type: KeyF4}, // urxvt
+
+	"\x1b[15~": {Type: KeyF5}, // vt100, xterm, also urxvt
+
+	"\x1b[15;3~": {Type: KeyF5, Alt: true}, // vt100, xterm, also urxvt
+
+	"\x1b[17~": {Type: KeyF6},  // vt100, xterm, also urxvt
+	"\x1b[18~": {Type: KeyF7},  // vt100, xterm, also urxvt
+	"\x1b[19~": {Type: KeyF8},  // vt100, xterm, also urxvt
+	"\x1b[20~": {Type: KeyF9},  // vt100, xterm, also urxvt
+	"\x1b[21~": {Type: KeyF10}, // vt100, xterm, also urxvt
+
+	"\x1b[17;3~": {Type: KeyF6, Alt: true},  // vt100, xterm
+	"\x1b[18;3~": {Type: KeyF7, Alt: true},  // vt100, xterm
+	"\x1b[19;3~": {Type: KeyF8, Alt: true},  // vt100, xterm
+	"\x1b[20;3~": {Type: KeyF9, Alt: true},  // vt100, xterm
+	"\x1b[21;3~": {Type: KeyF10, Alt: true}, // vt100, xterm
+
+	"\x1b[23~": {Type: KeyF11}, // vt100, xterm, also urxvt
+	"\x1b[24~": {Type: KeyF12}, // vt100, xterm, also urxvt
+
+	"\x1b[23;3~": {Type: KeyF11, Alt: true}, // vt100, xterm
+	"\x1b[24;3~": {Type: KeyF12, Alt: true}, // vt100, xterm
+
+	"\x1b[1;2P": {Type: KeyF13},
+	"\x1b[1;2Q": {Type: KeyF14},
+
+	"\x1b[25~": {Type: KeyF13}, // vt100, xterm, also urxvt
+	"\x1b[26~": {Type: KeyF14}, // vt100, xterm, also urxvt
+
+	"\x1b[25;3~": {Type: KeyF13, Alt: true}, // vt100, xterm
+	"\x1b[26;3~": {Type: KeyF14, Alt: true}, // vt100, xterm
+
+	"\x1b[1;2R": {Type: KeyF15},
+	"\x1b[1;2S": {Type: KeyF16},
+
+	"\x1b[28~": {Type: KeyF15}, // vt100, xterm, also urxvt
+	"\x1b[29~": {Type: KeyF16}, // vt100, xterm, also urxvt
+
+	"\x1b[28;3~": {Type: KeyF15, Alt: true}, // vt100, xterm
+	"\x1b[29;3~": {Type: KeyF16, Alt: true}, // vt100, xterm
+
+	"\x1b[15;2~": {Type: KeyF17},
+	"\x1b[17;2~": {Type: KeyF18},
+	"\x1b[18;2~": {Type: KeyF19},
+	"\x1b[19;2~": {Type: KeyF20},
+
+	"\x1b[31~": {Type: KeyF17},
+	"\x1b[32~": {Type: KeyF18},
+	"\x1b[33~": {Type: KeyF19},
+	"\x1b[34~": {Type: KeyF20},
+
+	// Powershell sequences.
+	"\x1bOA": {Type: KeyUp, Alt: false},
+	"\x1bOB": {Type: KeyDown, Alt: false},
+	"\x1bOC": {Type: KeyRight, Alt: false},
+	"\x1bOD": {Type: KeyLeft, Alt: false},
+}
+
+// unknownInputByteMsg is reported by the input reader when an invalid
+// utf-8 byte is detected on the input. Currently, it is not handled
+// further by bubbletea. However, having this event makes it possible
+// to troubleshoot invalid inputs.
+type unknownInputByteMsg byte
+
+func (u unknownInputByteMsg) String() string {
+	return fmt.Sprintf("?%#02x?", int(u))
+}
+
+// unknownCSISequenceMsg is reported by the input reader when an
+// unrecognized CSI sequence is detected on the input. Currently, it
+// is not handled further by bubbletea. However, having this event
+// makes it possible to troubleshoot invalid inputs.
+type unknownCSISequenceMsg []byte
+
+func (u unknownCSISequenceMsg) String() string {
+	return fmt.Sprintf("?CSI%+v?", []byte(u)[2:])
+}
+
+var spaceRunes = []rune{' '}
+
+// readAnsiInputs reads keypress and mouse inputs from a TTY and produces messages
+// containing information about the key or mouse events accordingly.
+func readAnsiInputs(ctx context.Context, msgs chan<- Msg, input io.Reader) error {
+	var buf [256]byte
+
+	var leftOverFromPrevIteration []byte
+loop:
+	for {
+		// Read and block.
+		numBytes, err := input.Read(buf[:])
+		if err != nil {
+			return fmt.Errorf("error reading input: %w", err)
+		}
+		b := buf[:numBytes]
+		if leftOverFromPrevIteration != nil {
+			b = append(leftOverFromPrevIteration, b...)
+		}
+
+		// If we had a short read (numBytes < len(buf)), we're sure that
+		// the end of this read is an event boundary, so there is no doubt
+		// if we are encountering the end of the buffer while parsing a message.
+		// However, if we've succeeded in filling up the buffer, there may
+		// be more data in the OS buffer ready to be read in, to complete
+		// the last message in the input. In that case, we will retry with
+		// the left over data in the next iteration.
+		canHaveMoreData := numBytes == len(buf)
+
+		var i, w int
+		for i, w = 0, 0; i < len(b); i += w {
+			var msg Msg
+			w, msg = detectOneMsg(b[i:], canHaveMoreData)
+			if w == 0 {
+				// Expecting more bytes beyond the current buffer. Try waiting
+				// for more input.
+				leftOverFromPrevIteration = make([]byte, 0, len(b[i:])+len(buf))
+				leftOverFromPrevIteration = append(leftOverFromPrevIteration, b[i:]...)
+				continue loop
+			}
+
+			select {
+			case msgs <- msg:
+			case <-ctx.Done():
+				err := ctx.Err()
+				if err != nil {
+					err = fmt.Errorf("found context error while reading input: %w", err)
+				}
+				return err
+			}
+		}
+		leftOverFromPrevIteration = nil
+	}
+}
+
+var (
+	unknownCSIRe  = regexp.MustCompile(`^\x1b\[[\x30-\x3f]*[\x20-\x2f]*[\x40-\x7e]`)
+	mouseSGRRegex = regexp.MustCompile(`(\d+);(\d+);(\d+)([Mm])`)
+)
+
+func detectOneMsg(b []byte, canHaveMoreData bool) (w int, msg Msg) {
+	// Detect mouse events.
+	// X10 mouse events have a length of 6 bytes
+	const mouseEventX10Len = 6
+	if len(b) >= mouseEventX10Len && b[0] == '\x1b' && b[1] == '[' {
+		switch b[2] {
+		case 'M':
+			return mouseEventX10Len, MouseMsg(parseX10MouseEvent(b))
+		case '<':
+			if matchIndices := mouseSGRRegex.FindSubmatchIndex(b[3:]); matchIndices != nil {
+				// SGR mouse events length is the length of the match plus the length of the escape sequence
+				mouseEventSGRLen := matchIndices[1] + 3 //nolint:mnd
+				return mouseEventSGRLen, MouseMsg(parseSGRMouseEvent(b))
+			}
+		}
+	}
+
+	// Detect focus events.
+	var foundRF bool
+	foundRF, w, msg = detectReportFocus(b)
+	if foundRF {
+		return w, msg
+	}
+
+	// Detect bracketed paste.
+	var foundbp bool
+	foundbp, w, msg = detectBracketedPaste(b)
+	if foundbp {
+		return w, msg
+	}
+
+	// Detect escape sequence and control characters other than NUL,
+	// possibly with an escape character in front to mark the Alt
+	// modifier.
+	var foundSeq bool
+	foundSeq, w, msg = detectSequence(b)
+	if foundSeq {
+		return w, msg
+	}
+
+	// No non-NUL control character or escape sequence.
+	// If we are seeing at least an escape character, remember it for later below.
+	alt := false
+	i := 0
+	if b[0] == '\x1b' {
+		alt = true
+		i++
+	}
+
+	// Are we seeing a standalone NUL? This is not handled by detectSequence().
+	if i < len(b) && b[i] == 0 {
+		return i + 1, KeyMsg{Type: keyNUL, Alt: alt}
+	}
+
+	// Find the longest sequence of runes that are not control
+	// characters from this point.
+	var runes []rune
+	for rw := 0; i < len(b); i += rw {
+		var r rune
+		r, rw = utf8.DecodeRune(b[i:])
+		if r == utf8.RuneError || r <= rune(keyUS) || r == rune(keyDEL) || r == ' ' {
+			// Rune errors are handled below; control characters and spaces will
+			// be handled by detectSequence in the next call to detectOneMsg.
+			break
+		}
+		runes = append(runes, r)
+		if alt {
+			// We only support a single rune after an escape alt modifier.
+			i += rw
+			break
+		}
+	}
+	if i >= len(b) && canHaveMoreData {
+		// We have encountered the end of the input buffer. Alas, we can't
+		// be sure whether the data in the remainder of the buffer is
+		// complete (maybe there was a short read). Instead of sending anything
+		// dumb to the message channel, do a short read. The outer loop will
+		// handle this case by extending the buffer as necessary.
+		return 0, nil
+	}
+
+	// If we found at least one rune, we report the bunch of them as
+	// a single KeyRunes or KeySpace event.
+	if len(runes) > 0 {
+		k := Key{Type: KeyRunes, Runes: runes, Alt: alt}
+		if len(runes) == 1 && runes[0] == ' ' {
+			k.Type = KeySpace
+		}
+		return i, KeyMsg(k)
+	}
+
+	// We didn't find an escape sequence, nor a valid rune. Was this a
+	// lone escape character at the end of the input?
+	if alt && len(b) == 1 {
+		return 1, KeyMsg(Key{Type: KeyEscape})
+	}
+
+	// The character at the current position is neither an escape
+	// sequence, a valid rune start or a sole escape character. Report
+	// it as an invalid byte.
+	return 1, unknownInputByteMsg(b[0])
+}

vendor/github.com/charmbracelet/bubbletea/key_other.go

@@ -0,0 +1,13 @@
+//go:build !windows
+// +build !windows
+
+package tea
+
+import (
+	"context"
+	"io"
+)
+
+func readInputs(ctx context.Context, msgs chan<- Msg, input io.Reader) error {
+	return readAnsiInputs(ctx, msgs, input)
+}

vendor/github.com/charmbracelet/bubbletea/key_sequences.go

@@ -0,0 +1,130 @@
+package tea
+
+import (
+	"bytes"
+	"sort"
+	"unicode/utf8"
+)
+
+// extSequences is used by the map-based algorithm below. It contains
+// the sequences plus their alternatives with an escape character
+// prefixed, plus the control chars, plus the space.
+// It does not contain the NUL character, which is handled specially
+// by detectOneMsg.
+var extSequences = func() map[string]Key {
+	s := map[string]Key{}
+	for seq, key := range sequences {
+		key := key
+		s[seq] = key
+		if !key.Alt {
+			key.Alt = true
+			s["\x1b"+seq] = key
+		}
+	}
+	for i := keyNUL + 1; i <= keyDEL; i++ {
+		if i == keyESC {
+			continue
+		}
+		s[string([]byte{byte(i)})] = Key{Type: i}
+		s[string([]byte{'\x1b', byte(i)})] = Key{Type: i, Alt: true}
+		if i == keyUS {
+			i = keyDEL - 1
+		}
+	}
+	s[" "] = Key{Type: KeySpace, Runes: spaceRunes}
+	s["\x1b "] = Key{Type: KeySpace, Alt: true, Runes: spaceRunes}
+	s["\x1b\x1b"] = Key{Type: KeyEscape, Alt: true}
+	return s
+}()
+
+// seqLengths is the sizes of valid sequences, starting with the
+// largest size.
+var seqLengths = func() []int {
+	sizes := map[int]struct{}{}
+	for seq := range extSequences {
+		sizes[len(seq)] = struct{}{}
+	}
+	lsizes := make([]int, 0, len(sizes))
+	for sz := range sizes {
+		lsizes = append(lsizes, sz)
+	}
+	sort.Slice(lsizes, func(i, j int) bool { return lsizes[i] > lsizes[j] })
+	return lsizes
+}()
+
+// detectSequence uses a longest prefix match over the input
+// sequence and a hash map.
+func detectSequence(input []byte) (hasSeq bool, width int, msg Msg) {
+	seqs := extSequences
+	for _, sz := range seqLengths {
+		if sz > len(input) {
+			continue
+		}
+		prefix := input[:sz]
+		key, ok := seqs[string(prefix)]
+		if ok {
+			return true, sz, KeyMsg(key)
+		}
+	}
+	// Is this an unknown CSI sequence?
+	if loc := unknownCSIRe.FindIndex(input); loc != nil {
+		return true, loc[1], unknownCSISequenceMsg(input[:loc[1]])
+	}
+
+	return false, 0, nil
+}
+
+// detectBracketedPaste detects an input pasted while bracketed
+// paste mode was enabled.
+//
+// Note: this function is a no-op if bracketed paste was not enabled
+// on the terminal, since in that case we'd never see this
+// particular escape sequence.
+func detectBracketedPaste(input []byte) (hasBp bool, width int, msg Msg) {
+	// Detect the start sequence.
+	const bpStart = "\x1b[200~"
+	if len(input) < len(bpStart) || string(input[:len(bpStart)]) != bpStart {
+		return false, 0, nil
+	}
+
+	// Skip over the start sequence.
+	input = input[len(bpStart):]
+
+	// If we saw the start sequence, then we must have an end sequence
+	// as well. Find it.
+	const bpEnd = "\x1b[201~"
+	idx := bytes.Index(input, []byte(bpEnd))
+	inputLen := len(bpStart) + idx + len(bpEnd)
+	if idx == -1 {
+		// We have encountered the end of the input buffer without seeing
+		// the marker for the end of the bracketed paste.
+		// Tell the outer loop we have done a short read and we want more.
+		return true, 0, nil
+	}
+
+	// The paste is everything in-between.
+	paste := input[:idx]
+
+	// All there is in-between is runes, not to be interpreted further.
+	k := Key{Type: KeyRunes, Paste: true}
+	for len(paste) > 0 {
+		r, w := utf8.DecodeRune(paste)
+		if r != utf8.RuneError {
+			k.Runes = append(k.Runes, r)
+		}
+		paste = paste[w:]
+	}
+
+	return true, inputLen, KeyMsg(k)
+}
+
+// detectReportFocus detects a focus report sequence.
+func detectReportFocus(input []byte) (hasRF bool, width int, msg Msg) {
+	switch {
+	case bytes.Equal(input, []byte("\x1b[I")):
+		return true, 3, FocusMsg{} //nolint:mnd
+	case bytes.Equal(input, []byte("\x1b[O")):
+		return true, 3, BlurMsg{} //nolint:mnd
+	}
+	return false, 0, nil
+}

vendor/github.com/charmbracelet/bubbletea/key_windows.go

@@ -0,0 +1,441 @@
+//go:build windows
+// +build windows
+
+package tea
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"time"
+
+	"github.com/erikgeiser/coninput"
+	localereader "github.com/mattn/go-localereader"
+	"github.com/muesli/cancelreader"
+)
+
+func readInputs(ctx context.Context, msgs chan<- Msg, input io.Reader) error {
+	if coninReader, ok := input.(*conInputReader); ok {
+		return readConInputs(ctx, msgs, coninReader)
+	}
+
+	return readAnsiInputs(ctx, msgs, localereader.NewReader(input))
+}
+
+func readConInputs(ctx context.Context, msgsch chan<- Msg, con *conInputReader) error {
+	var ps coninput.ButtonState                 // keep track of previous mouse state
+	var ws coninput.WindowBufferSizeEventRecord // keep track of the last window size event
+	for {
+		events, err := peekAndReadConsInput(con)
+		if err != nil {
+			return err
+		}
+		for _, event := range events {
+			var msgs []Msg
+			switch e := event.Unwrap().(type) {
+			case coninput.KeyEventRecord:
+				if !e.KeyDown || e.VirtualKeyCode == coninput.VK_SHIFT {
+					continue
+				}
+
+				for i := 0; i < int(e.RepeatCount); i++ {
+					eventKeyType := keyType(e)
+					var runes []rune
+
+					// Add the character only if the key type is an actual character and not a control sequence.
+					// This mimics the behavior in readAnsiInputs where the character is also removed.
+					// We don't need to handle KeySpace here. See the comment in keyType().
+					if eventKeyType == KeyRunes {
+						runes = []rune{e.Char}
+					}
+
+					msgs = append(msgs, KeyMsg{
+						Type:  eventKeyType,
+						Runes: runes,
+						Alt:   e.ControlKeyState.Contains(coninput.LEFT_ALT_PRESSED | coninput.RIGHT_ALT_PRESSED),
+					})
+				}
+			case coninput.WindowBufferSizeEventRecord:
+				if e != ws {
+					ws = e
+					msgs = append(msgs, WindowSizeMsg{
+						Width:  int(e.Size.X),
+						Height: int(e.Size.Y),
+					})
+				}
+			case coninput.MouseEventRecord:
+				event := mouseEvent(ps, e)
+				if event.Type != MouseUnknown {
+					msgs = append(msgs, event)
+				}
+				ps = e.ButtonState
+			case coninput.FocusEventRecord, coninput.MenuEventRecord:
+				// ignore
+			default: // unknown event
+				continue
+			}
+
+			// Send all messages to the channel
+			for _, msg := range msgs {
+				select {
+				case msgsch <- msg:
+				case <-ctx.Done():
+					err := ctx.Err()
+					if err != nil {
+						return fmt.Errorf("coninput context error: %w", err)
+					}
+					return nil
+				}
+			}
+		}
+	}
+}
+
+// Peek for new input in a tight loop and then read the input.
+// windows.CancelIo* does not work reliably so peek first and only use the data if
+// the console input is not cancelled.
+func peekAndReadConsInput(con *conInputReader) ([]coninput.InputRecord, error) {
+	events, err := peekConsInput(con)
+	if err != nil {
+		return events, err
+	}
+	events, err = coninput.ReadNConsoleInputs(con.conin, intToUint32OrDie(len(events)))
+	if con.isCanceled() {
+		return events, cancelreader.ErrCanceled
+	}
+	if err != nil {
+		return events, fmt.Errorf("read coninput events: %w", err)
+	}
+	return events, nil
+}
+
+// Convert i to unit32 or panic if it cannot be converted. Check satisifes lint G115.
+func intToUint32OrDie(i int) uint32 {
+	if i < 0 {
+		panic("cannot convert numEvents " + fmt.Sprint(i) + " to uint32")
+	}
+	return uint32(i)
+}
+
+// Keeps peeking until there is data or the input is cancelled.
+func peekConsInput(con *conInputReader) ([]coninput.InputRecord, error) {
+	for {
+		events, err := coninput.PeekNConsoleInputs(con.conin, 16)
+		if con.isCanceled() {
+			return events, cancelreader.ErrCanceled
+		}
+		if err != nil {
+			return events, fmt.Errorf("peek coninput events: %w", err)
+		}
+		if len(events) > 0 {
+			return events, nil
+		}
+		// Sleep for a bit to avoid busy waiting.
+		time.Sleep(16 * time.Millisecond)
+	}
+}
+
+func mouseEventButton(p, s coninput.ButtonState) (button MouseButton, action MouseAction) {
+	btn := p ^ s
+	action = MouseActionPress
+	if btn&s == 0 {
+		action = MouseActionRelease
+	}
+
+	if btn == 0 {
+		switch {
+		case s&coninput.FROM_LEFT_1ST_BUTTON_PRESSED > 0:
+			button = MouseButtonLeft
+		case s&coninput.FROM_LEFT_2ND_BUTTON_PRESSED > 0:
+			button = MouseButtonMiddle
+		case s&coninput.RIGHTMOST_BUTTON_PRESSED > 0:
+			button = MouseButtonRight
+		case s&coninput.FROM_LEFT_3RD_BUTTON_PRESSED > 0:
+			button = MouseButtonBackward
+		case s&coninput.FROM_LEFT_4TH_BUTTON_PRESSED > 0:
+			button = MouseButtonForward
+		}
+		return button, action
+	}
+
+	switch {
+	case btn == coninput.FROM_LEFT_1ST_BUTTON_PRESSED: // left button
+		button = MouseButtonLeft
+	case btn == coninput.RIGHTMOST_BUTTON_PRESSED: // right button
+		button = MouseButtonRight
+	case btn == coninput.FROM_LEFT_2ND_BUTTON_PRESSED: // middle button
+		button = MouseButtonMiddle
+	case btn == coninput.FROM_LEFT_3RD_BUTTON_PRESSED: // unknown (possibly mouse backward)
+		button = MouseButtonBackward
+	case btn == coninput.FROM_LEFT_4TH_BUTTON_PRESSED: // unknown (possibly mouse forward)
+		button = MouseButtonForward
+	}
+
+	return button, action
+}
+
+func mouseEvent(p coninput.ButtonState, e coninput.MouseEventRecord) MouseMsg {
+	ev := MouseMsg{
+		X:     int(e.MousePositon.X),
+		Y:     int(e.MousePositon.Y),
+		Alt:   e.ControlKeyState.Contains(coninput.LEFT_ALT_PRESSED | coninput.RIGHT_ALT_PRESSED),
+		Ctrl:  e.ControlKeyState.Contains(coninput.LEFT_CTRL_PRESSED | coninput.RIGHT_CTRL_PRESSED),
+		Shift: e.ControlKeyState.Contains(coninput.SHIFT_PRESSED),
+	}
+	switch e.EventFlags {
+	case coninput.CLICK, coninput.DOUBLE_CLICK:
+		ev.Button, ev.Action = mouseEventButton(p, e.ButtonState)
+		if ev.Action == MouseActionRelease {
+			ev.Type = MouseRelease
+		}
+		switch ev.Button { //nolint:exhaustive
+		case MouseButtonLeft:
+			ev.Type = MouseLeft
+		case MouseButtonMiddle:
+			ev.Type = MouseMiddle
+		case MouseButtonRight:
+			ev.Type = MouseRight
+		case MouseButtonBackward:
+			ev.Type = MouseBackward
+		case MouseButtonForward:
+			ev.Type = MouseForward
+		}
+	case coninput.MOUSE_WHEELED:
+		if e.WheelDirection > 0 {
+			ev.Button = MouseButtonWheelUp
+			ev.Type = MouseWheelUp
+		} else {
+			ev.Button = MouseButtonWheelDown
+			ev.Type = MouseWheelDown
+		}
+	case coninput.MOUSE_HWHEELED:
+		if e.WheelDirection > 0 {
+			ev.Button = MouseButtonWheelRight
+			ev.Type = MouseWheelRight
+		} else {
+			ev.Button = MouseButtonWheelLeft
+			ev.Type = MouseWheelLeft
+		}
+	case coninput.MOUSE_MOVED:
+		ev.Button, _ = mouseEventButton(p, e.ButtonState)
+		ev.Action = MouseActionMotion
+		ev.Type = MouseMotion
+	}
+
+	return ev
+}
+
+func keyType(e coninput.KeyEventRecord) KeyType {
+	code := e.VirtualKeyCode
+
+	shiftPressed := e.ControlKeyState.Contains(coninput.SHIFT_PRESSED)
+	ctrlPressed := e.ControlKeyState.Contains(coninput.LEFT_CTRL_PRESSED | coninput.RIGHT_CTRL_PRESSED)
+
+	switch code { //nolint:exhaustive
+	case coninput.VK_RETURN:
+		return KeyEnter
+	case coninput.VK_BACK:
+		return KeyBackspace
+	case coninput.VK_TAB:
+		if shiftPressed {
+			return KeyShiftTab
+		}
+		return KeyTab
+	case coninput.VK_SPACE:
+		return KeyRunes // this could be KeySpace but on unix space also produces KeyRunes
+	case coninput.VK_ESCAPE:
+		return KeyEscape
+	case coninput.VK_UP:
+		switch {
+		case shiftPressed && ctrlPressed:
+			return KeyCtrlShiftUp
+		case shiftPressed:
+			return KeyShiftUp
+		case ctrlPressed:
+			return KeyCtrlUp
+		default:
+			return KeyUp
+		}
+	case coninput.VK_DOWN:
+		switch {
+		case shiftPressed && ctrlPressed:
+			return KeyCtrlShiftDown
+		case shiftPressed:
+			return KeyShiftDown
+		case ctrlPressed:
+			return KeyCtrlDown
+		default:
+			return KeyDown
+		}
+	case coninput.VK_RIGHT:
+		switch {
+		case shiftPressed && ctrlPressed:
+			return KeyCtrlShiftRight
+		case shiftPressed:
+			return KeyShiftRight
+		case ctrlPressed:
+			return KeyCtrlRight
+		default:
+			return KeyRight
+		}
+	case coninput.VK_LEFT:
+		switch {
+		case shiftPressed && ctrlPressed:
+			return KeyCtrlShiftLeft
+		case shiftPressed:
+			return KeyShiftLeft
+		case ctrlPressed:
+			return KeyCtrlLeft
+		default:
+			return KeyLeft
+		}
+	case coninput.VK_HOME:
+		switch {
+		case shiftPressed && ctrlPressed:
+			return KeyCtrlShiftHome
+		case shiftPressed:
+			return KeyShiftHome
+		case ctrlPressed:
+			return KeyCtrlHome
+		default:
+			return KeyHome
+		}
+	case coninput.VK_END:
+		switch {
+		case shiftPressed && ctrlPressed:
+			return KeyCtrlShiftEnd
+		case shiftPressed:
+			return KeyShiftEnd
+		case ctrlPressed:
+			return KeyCtrlEnd
+		default:
+			return KeyEnd
+		}
+	case coninput.VK_PRIOR:
+		return KeyPgUp
+	case coninput.VK_NEXT:
+		return KeyPgDown
+	case coninput.VK_DELETE:
+		return KeyDelete
+	case coninput.VK_F1:
+		return KeyF1
+	case coninput.VK_F2:
+		return KeyF2
+	case coninput.VK_F3:
+		return KeyF3
+	case coninput.VK_F4:
+		return KeyF4
+	case coninput.VK_F5:
+		return KeyF5
+	case coninput.VK_F6:
+		return KeyF6
+	case coninput.VK_F7:
+		return KeyF7
+	case coninput.VK_F8:
+		return KeyF8
+	case coninput.VK_F9:
+		return KeyF9
+	case coninput.VK_F10:
+		return KeyF10
+	case coninput.VK_F11:
+		return KeyF11
+	case coninput.VK_F12:
+		return KeyF12
+	case coninput.VK_F13:
+		return KeyF13
+	case coninput.VK_F14:
+		return KeyF14
+	case coninput.VK_F15:
+		return KeyF15
+	case coninput.VK_F16:
+		return KeyF16
+	case coninput.VK_F17:
+		return KeyF17
+	case coninput.VK_F18:
+		return KeyF18
+	case coninput.VK_F19:
+		return KeyF19
+	case coninput.VK_F20:
+		return KeyF20
+	default:
+		switch {
+		case e.ControlKeyState.Contains(coninput.LEFT_CTRL_PRESSED) && e.ControlKeyState.Contains(coninput.RIGHT_ALT_PRESSED):
+			// AltGr is pressed, then it's a rune.
+			fallthrough
+		case !e.ControlKeyState.Contains(coninput.LEFT_CTRL_PRESSED) && !e.ControlKeyState.Contains(coninput.RIGHT_CTRL_PRESSED):
+			return KeyRunes
+		}
+
+		switch e.Char {
+		case '@':
+			return KeyCtrlAt
+		case '\x01':
+			return KeyCtrlA
+		case '\x02':
+			return KeyCtrlB
+		case '\x03':
+			return KeyCtrlC
+		case '\x04':
+			return KeyCtrlD
+		case '\x05':
+			return KeyCtrlE
+		case '\x06':
+			return KeyCtrlF
+		case '\a':
+			return KeyCtrlG
+		case '\b':
+			return KeyCtrlH
+		case '\t':
+			return KeyCtrlI
+		case '\n':
+			return KeyCtrlJ
+		case '\v':
+			return KeyCtrlK
+		case '\f':
+			return KeyCtrlL
+		case '\r':
+			return KeyCtrlM
+		case '\x0e':
+			return KeyCtrlN
+		case '\x0f':
+			return KeyCtrlO
+		case '\x10':
+			return KeyCtrlP
+		case '\x11':
+			return KeyCtrlQ
+		case '\x12':
+			return KeyCtrlR
+		case '\x13':
+			return KeyCtrlS
+		case '\x14':
+			return KeyCtrlT
+		case '\x15':
+			return KeyCtrlU
+		case '\x16':
+			return KeyCtrlV
+		case '\x17':
+			return KeyCtrlW
+		case '\x18':
+			return KeyCtrlX
+		case '\x19':
+			return KeyCtrlY
+		case '\x1a':
+			return KeyCtrlZ
+		case '\x1b':
+			return KeyCtrlOpenBracket // KeyEscape
+		case '\x1c':
+			return KeyCtrlBackslash
+		case '\x1f':
+			return KeyCtrlUnderscore
+		}
+
+		switch code { //nolint:exhaustive
+		case coninput.VK_OEM_4:
+			return KeyCtrlOpenBracket
+		case coninput.VK_OEM_6:
+			return KeyCtrlCloseBracket
+		}
+
+		return KeyRunes
+	}
+}

vendor/github.com/charmbracelet/bubbletea/logging.go

@@ -0,0 +1,53 @@
+package tea
+
+import (
+	"fmt"
+	"io"
+	"log"
+	"os"
+	"unicode"
+)
+
+// LogToFile sets up default logging to log to a file. This is helpful as we
+// can't print to the terminal since our TUI is occupying it. If the file
+// doesn't exist it will be created.
+//
+// Don't forget to close the file when you're done with it.
+//
+//	  f, err := LogToFile("debug.log", "debug")
+//	  if err != nil {
+//			fmt.Println("fatal:", err)
+//			os.Exit(1)
+//	  }
+//	  defer f.Close()
+func LogToFile(path string, prefix string) (*os.File, error) {
+	return LogToFileWith(path, prefix, log.Default())
+}
+
+// LogOptionsSetter is an interface implemented by stdlib's log and charm's log
+// libraries.
+type LogOptionsSetter interface {
+	SetOutput(io.Writer)
+	SetPrefix(string)
+}
+
+// LogToFileWith does allows to call LogToFile with a custom LogOptionsSetter.
+func LogToFileWith(path string, prefix string, log LogOptionsSetter) (*os.File, error) {
+	f, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_APPEND, 0o600) //nolint:mnd
+	if err != nil {
+		return nil, fmt.Errorf("error opening file for logging: %w", err)
+	}
+	log.SetOutput(f)
+
+	// Add a space after the prefix if a prefix is being specified and it
+	// doesn't already have a trailing space.
+	if len(prefix) > 0 {
+		finalChar := prefix[len(prefix)-1]
+		if !unicode.IsSpace(rune(finalChar)) {
+			prefix += " "
+		}
+	}
+	log.SetPrefix(prefix)
+
+	return f, nil
+}