diff --git a/cmd/config/example.go b/cmd/config/example.go
index 4d460ebbf..ac882e5e6 100644
--- a/cmd/config/example.go
+++ b/cmd/config/example.go
@@ -67,7 +67,14 @@ func commandExample(cCtx *cli.Context) error { //nolint:funlen,maintidx
 					Cpu:    500,
 					Memory: 1024,
 				},
-				Replicas: 1,
+				Replicas: ptr(uint8(1)),
+				Networking: &model.ConfigNetworking{
+					Ingresses: []*model.ConfigIngress{
+						{
+							Fqdn: []string{"hasura.example.com"},
+						},
+					},
+				},
 			},
 		},
 		Functions: &model.ConfigFunctions{
@@ -82,7 +89,14 @@ func commandExample(cCtx *cli.Context) error { //nolint:funlen,maintidx
 					Cpu:    250,
 					Memory: 512,
 				},
-				Replicas: 1,
+				Replicas: ptr(uint8(1)),
+				Networking: &model.ConfigNetworking{
+					Ingresses: []*model.ConfigIngress{
+						{
+							Fqdn: []string{"auth.example.com"},
+						},
+					},
+				},
 			},
 			Redirections: &model.ConfigAuthRedirections{
 				ClientUrl: ptr("https://example.com"),
@@ -258,12 +272,16 @@ func commandExample(cCtx *cli.Context) error { //nolint:funlen,maintidx
 		},
 		Postgres: &model.ConfigPostgres{
 			Version: ptr("14-20230312-1"),
-			Resources: &model.ConfigResources{
+			Resources: &model.ConfigPostgresResources{
 				Compute: &model.ConfigResourcesCompute{
 					Cpu:    2000,
 					Memory: 4096,
 				},
-				Replicas: 1,
+				Replicas:   ptr(uint8(1)),
+				Networking: nil,
+				Storage: &model.ConfigPostgresStorage{
+					Capacity: 20,
+				},
 			},
 			Settings: &model.ConfigPostgresSettings{
 				Jit:                           ptr("off"),
@@ -313,7 +331,8 @@ func commandExample(cCtx *cli.Context) error { //nolint:funlen,maintidx
 					Cpu:    500,
 					Memory: 1024,
 				},
-				Replicas: 1,
+				Networking: nil,
+				Replicas:   ptr(uint8(1)),
 			},
 		},
 		Observability: &model.ConfigObservability{
diff --git a/cmd/run/config_example.go b/cmd/run/config_example.go
new file mode 100644
index 000000000..af67bb174
--- /dev/null
+++ b/cmd/run/config_example.go
@@ -0,0 +1,95 @@
+package run
+
+import (
+	"fmt"
+
+	"github.com/nhost/be/services/mimir/model"
+	"github.com/nhost/be/services/mimir/schema"
+	"github.com/nhost/cli/clienv"
+	"github.com/pelletier/go-toml/v2"
+	"github.com/urfave/cli/v2"
+)
+
+func ptr[T any](v T) *T {
+	return &v
+}
+
+func CommandConfigExample() *cli.Command {
+	return &cli.Command{ //nolint:exhaustruct
+		Name:    "config-example",
+		Aliases: []string{},
+		Usage:   "Shows an example config file",
+		Action:  commandConfigExample,
+		Flags:   []cli.Flag{},
+	}
+}
+
+func commandConfigExample(cCtx *cli.Context) error { //nolint:funlen
+	ce := clienv.FromCLI(cCtx)
+
+	//nolint:gomnd
+	cfg := &model.ConfigRunServiceConfig{
+		Name: "my-run-service",
+		Image: &model.ConfigRunServiceImage{
+			Image: "docker.io/org/img:latest",
+		},
+		Command: []string{
+			"start",
+		},
+		Environment: []*model.ConfigEnvironmentVariable{
+			{
+				Name:  "ENV_VAR1",
+				Value: "value1",
+			},
+			{
+				Name:  "ENV_VAR2",
+				Value: "value2",
+			},
+		},
+		Ports: []*model.ConfigRunServicePort{
+			{
+				Port:    8080,
+				Type:    "http",
+				Publish: ptr(true),
+				Ingresses: []*model.ConfigIngress{
+					{
+						Fqdn: []string{"my-run-service.acme.com"},
+					},
+				},
+			},
+		},
+		Resources: &model.ConfigRunServiceResources{
+			Compute: &model.ConfigRunServiceResourcesCompute{
+				Cpu:    125,
+				Memory: 256,
+			},
+			Storage: []*model.ConfigRunServiceResourcesStorage{
+				{
+					Name:     "my-storage",
+					Capacity: 1,
+					Path:     "/var/lib/my-storage",
+				},
+			},
+			Replicas: 1,
+		},
+	}
+
+	sch, err := schema.New()
+	if err != nil {
+		return fmt.Errorf("failed to create schema: %w", err)
+	}
+
+	cfg, err = sch.FillRunServiceConfig(cfg)
+	if err != nil {
+		return fmt.Errorf("failed to validate config: %w", err)
+	}
+
+	b, err := toml.Marshal(cfg)
+	if err != nil {
+		return fmt.Errorf("failed to marshal config: %w", err)
+	}
+
+	ce.Println(string(b))
+
+	return nil
+}
diff --git a/cmd/run/run.go b/cmd/run/run.go
index 1c9c303ba..071c91fd1 100644
--- a/cmd/run/run.go
+++ b/cmd/run/run.go
@@ -12,6 +12,7 @@ func Command() *cli.Command {
 			CommandConfigEditImage(),
 			CommandConfigPull(),
 			CommandConfigValidate(),
+			CommandConfigExample(),
 		},
 	}
 }
diff --git a/dockercompose/main_test.go b/dockercompose/main_test.go
index ae1b66bf2..f8023cbe4 100644
--- a/dockercompose/main_test.go
+++ b/dockercompose/main_test.go
@@ -12,7 +12,8 @@ func getConfig() *model.ConfigConfig { //nolint:maintidx
 					Cpu:    1000,
 					Memory: 300,
 				},
-				Replicas: 3,
+				Replicas:   ptr(uint8(3)),
+				Networking: nil,
 			},
 			Method: &model.ConfigAuthMethod{
 				Anonymous: &model.ConfigAuthMethodAnonymous{
@@ -206,7 +207,8 @@ func getConfig() *model.ConfigConfig { //nolint:maintidx
 					Cpu:    1000,
 					Memory: 700,
 				},
-				Replicas: 3,
+				Replicas:   ptr(uint8(3)),
+				Networking: nil,
 			},
 			AdminSecret: "adminSecret",
 			JwtSecrets: []*model.ConfigJWTSecret{
@@ -246,12 +248,14 @@ func getConfig() *model.ConfigConfig { //nolint:maintidx
 		},
 		Postgres: &model.ConfigPostgres{
 			Version: ptr("14.5-20220831-1"),
-			Resources: &model.ConfigResources{
+			Resources: &model.ConfigPostgresResources{
 				Compute: &model.ConfigResourcesCompute{
 					Cpu:    2000,
 					Memory: 500,
 				},
-				Replicas: 1,
+				Replicas:   ptr(uint8(1)),
+				Networking: nil,
+				Storage:    nil,
 			},
 			Settings: nil,
 		},
@@ -278,7 +282,8 @@ func getConfig() *model.ConfigConfig { //nolint:maintidx
 					Cpu:    500,
 					Memory: 50,
 				},
-				Replicas: 1,
+				Replicas:   ptr(uint8(1)),
+				Networking: nil,
 			},
 			Antivirus: &model.ConfigStorageAntivirus{
 				Server: ptr("tcp://run-clamav:3310"),
diff --git a/examples/myproject/nhost/nhost.toml b/examples/myproject/nhost/nhost.toml
index abf07a0a8..f49459ca6 100644
--- a/examples/myproject/nhost/nhost.toml
+++ b/examples/myproject/nhost/nhost.toml
@@ -139,7 +139,7 @@ sharedBuffers = '256MB'
 effectiveCacheSize = '768MB'
 maintenanceWorkMem = '64MB'
 checkpointCompletionTarget = 0.9
-walBuffers = -1
+walBuffers = "-1"
 defaultStatisticsTarget = 100
 randomPageCost = 1.1
 effectiveIOConcurrency = 200
diff --git a/go.mod b/go.mod
index 86e26d5bb..2fa96deb0 100644
--- a/go.mod
+++ b/go.mod
@@ -2,41 +2,43 @@ module github.com/nhost/cli
 
 go 1.21
 
+replace cuelang.org/go => cuelang.org/go v0.4.3
+
 require (
-	github.com/Yamashou/gqlgenc v0.15.0
-	github.com/charmbracelet/lipgloss v0.8.0
+	github.com/Yamashou/gqlgenc v0.15.1
+	github.com/charmbracelet/lipgloss v0.9.1
 	github.com/creack/pty v1.1.18
 	github.com/go-git/go-git/v5 v5.9.0
-	github.com/google/go-cmp v0.5.9
-	github.com/hashicorp/go-getter v1.7.2
-	github.com/nhost/be v0.0.0-20231001065154-f72edc119cf0
-	github.com/pelletier/go-toml/v2 v2.0.8
+	github.com/google/go-cmp v0.6.0
+	github.com/hashicorp/go-getter v1.7.3
+	github.com/nhost/be v0.0.0-20231018093831-a53b01c2d071
+	github.com/pelletier/go-toml/v2 v2.1.0
 	github.com/urfave/cli/v2 v2.25.7
 	github.com/wI2L/jsondiff v0.4.0
-	golang.org/x/mod v0.12.0
-	golang.org/x/term v0.12.0
+	golang.org/x/mod v0.13.0
+	golang.org/x/term v0.13.0
 	gopkg.in/evanphx/json-patch.v5 v5.7.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
 	cloud.google.com/go v0.110.8 // indirect
-	cloud.google.com/go/compute v1.23.0 // indirect
+	cloud.google.com/go/compute v1.23.1 // indirect
 	cloud.google.com/go/compute/metadata v0.2.3 // indirect
-	cloud.google.com/go/iam v1.1.2 // indirect
+	cloud.google.com/go/iam v1.1.3 // indirect
 	cloud.google.com/go/storage v1.33.0 // indirect
 	cuelang.org/go v0.5.0 // indirect
 	dario.cat/mergo v1.0.0 // indirect
-	github.com/99designs/gqlgen v0.17.38 // indirect
+	github.com/99designs/gqlgen v0.17.39 // indirect
 	github.com/Microsoft/go-winio v0.6.1 // indirect
 	github.com/ProtonMail/go-crypto v0.0.0-20230923063757-afb1ddc0824c // indirect
 	github.com/acomagu/bufpipe v1.0.4 // indirect
-	github.com/aws/aws-sdk-go v1.45.16 // indirect
+	github.com/aws/aws-sdk-go v1.45.25 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
 	github.com/cloudflare/circl v1.3.3 // indirect
 	github.com/cockroachdb/apd/v2 v2.0.2 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.3 // indirect
 	github.com/cyphar/filepath-securejoin v0.2.4 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
@@ -68,6 +70,7 @@ require (
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/sergi/go-diff v1.3.1 // indirect
 	github.com/skeema/knownhosts v1.2.1 // indirect
+	github.com/sosodev/duration v1.2.0 // indirect
 	github.com/ulikunitz/xz v0.5.11 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/valyala/fasttemplate v1.2.2 // indirect
@@ -75,22 +78,20 @@ require (
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	golang.org/x/crypto v0.13.0 // indirect
-	golang.org/x/net v0.15.0 // indirect
-	golang.org/x/oauth2 v0.12.0 // indirect
-	golang.org/x/sync v0.3.0 // indirect
-	golang.org/x/sys v0.12.0 // indirect
+	golang.org/x/crypto v0.14.0 // indirect
+	golang.org/x/net v0.17.0 // indirect
+	golang.org/x/oauth2 v0.13.0 // indirect
+	golang.org/x/sync v0.4.0 // indirect
+	golang.org/x/sys v0.13.0 // indirect
 	golang.org/x/text v0.13.0 // indirect
-	golang.org/x/tools v0.13.0 // indirect
-	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
-	google.golang.org/api v0.143.0 // indirect
+	golang.org/x/tools v0.14.0 // indirect
+	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
+	google.golang.org/api v0.147.0 // indirect
 	google.golang.org/appengine v1.6.8 // indirect
-	google.golang.org/genproto v0.0.0-20230920204549-e6e6cdab5c13 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20230920204549-e6e6cdab5c13 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20230920204549-e6e6cdab5c13 // indirect
-	google.golang.org/grpc v1.58.2 // indirect
+	google.golang.org/genproto v0.0.0-20231012201019-e917dd12ba7a // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20231012201019-e917dd12ba7a // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20231012201019-e917dd12ba7a // indirect
+	google.golang.org/grpc v1.58.3 // indirect
 	google.golang.org/protobuf v1.31.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 )
-
-replace github.com/pelletier/go-toml/v2 => github.com/dbarrosop/go-toml/v2 v2.0.0-20230603161714-891170c4bf79
diff --git a/go.sum b/go.sum
index 6464c390d..c5b9ced4d 100644
--- a/go.sum
+++ b/go.sum
@@ -68,8 +68,8 @@ cloud.google.com/go/compute v1.6.0/go.mod h1:T29tfhtVbq1wvAPo0E3+7vhgmkOYeXjhFvz
 cloud.google.com/go/compute v1.6.1/go.mod h1:g85FgpzFvNULZ+S8AYq87axRKuf2Kh7deLqV/jJ3thU=
 cloud.google.com/go/compute v1.7.0/go.mod h1:435lt8av5oL9P3fv1OEzSbSUe+ybHXGMPQHHZWZxy9U=
 cloud.google.com/go/compute v1.10.0/go.mod h1:ER5CLbMxl90o2jtNbGSbtfOpQKR0t15FOtRsugnLrlU=
-cloud.google.com/go/compute v1.23.0 h1:tP41Zoavr8ptEqaW6j+LQOnyBBhO7OkOMAGrgLopTwY=
-cloud.google.com/go/compute v1.23.0/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdiEZc9FEIbM=
+cloud.google.com/go/compute v1.23.1 h1:V97tBoDaZHb6leicZ1G6DLK2BAaZLJ/7+9BB/En3hR0=
+cloud.google.com/go/compute v1.23.1/go.mod h1:CqB3xpmPKKt3OJpW2ndFIXnA9A4xAy/F3Xp1ixncW78=
 cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
 cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
 cloud.google.com/go/containeranalysis v0.5.1/go.mod h1:1D92jd8gRR/c0fGMlymRgxWD3Qw9C1ff6/T7mLgVL8I=
@@ -109,8 +109,8 @@ cloud.google.com/go/gkehub v0.10.0/go.mod h1:UIPwxI0DsrpsVoWpLB0stwKCP+WFVG9+y97
 cloud.google.com/go/grafeas v0.2.0/go.mod h1:KhxgtF2hb0P191HlY5besjYm6MqTSTj3LSI+M+ByZHc=
 cloud.google.com/go/iam v0.3.0/go.mod h1:XzJPvDayI+9zsASAFO68Hk07u3z+f+JrT2xXNdp4bnY=
 cloud.google.com/go/iam v0.5.0/go.mod h1:wPU9Vt0P4UmCux7mqtRu6jcpPAb74cP1fh50J3QpkUc=
-cloud.google.com/go/iam v1.1.2 h1:gacbrBdWcoVmGLozRuStX45YKvJtzIjJdAolzUs1sm4=
-cloud.google.com/go/iam v1.1.2/go.mod h1:A5avdyVL2tCppe4unb0951eI9jreack+RJ0/d+KUZOU=
+cloud.google.com/go/iam v1.1.3 h1:18tKG7DzydKWUnLjonWcJO6wjSCAtzh4GcRKlH/Hrzc=
+cloud.google.com/go/iam v1.1.3/go.mod h1:3khUlaBXfPKKe7huYgEpDn6FtgRyMEqbkvBxrQyY5SE=
 cloud.google.com/go/language v1.4.0/go.mod h1:F9dRpNFQmJbkaop6g0JhSBXCNlO90e1KWx5iDdxbWic=
 cloud.google.com/go/language v1.6.0/go.mod h1:6dJ8t3B+lUYfStgls25GusK04NLh3eDLQnWM3mdEbhI=
 cloud.google.com/go/lifesciences v0.5.0/go.mod h1:3oIKy8ycWGPUyZDR/8RNnTOYevhaMLqh5vLUXs9zvT8=
@@ -184,13 +184,13 @@ cloud.google.com/go/webrisk v1.4.0/go.mod h1:Hn8X6Zr+ziE2aNd8SliSDWpEnSS1u4R9+xX
 cloud.google.com/go/webrisk v1.5.0/go.mod h1:iPG6fr52Tv7sGk0H6qUFzmL3HHZev1htXuWDEEsqMTg=
 cloud.google.com/go/workflows v1.6.0/go.mod h1:6t9F5h/unJz41YqfBmqSASJSXccBLtD1Vwf+KmJENM0=
 cloud.google.com/go/workflows v1.7.0/go.mod h1:JhSrZuVZWuiDfKEFxU0/F1PQjmpnpcoISEXH2bcHC3M=
-cuelang.org/go v0.5.0 h1:D6N0UgTGJCOxFKU8RU+qYvavKNsVc/+ZobmifStVJzU=
-cuelang.org/go v0.5.0/go.mod h1:okjJBHFQFer+a41sAe2SaGm1glWS8oEb6CmJvn5Zdws=
+cuelang.org/go v0.4.3 h1:W3oBBjDTm7+IZfCKZAmC8uDG0eYfJL4Pp/xbbCMKaVo=
+cuelang.org/go v0.4.3/go.mod h1:7805vR9H+VoBNdWFdI7jyDR3QLUPp4+naHfbcgp55HI=
 dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
 dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-github.com/99designs/gqlgen v0.17.38 h1:3r7G7i8UAdY0iYreNiBAA55auVsrowO0+ZhMl5g4GYU=
-github.com/99designs/gqlgen v0.17.38/go.mod h1:2v+dKtpI8mIzYeW9dYN8mO69tMmjszW2xKLNcWR/5wQ=
+github.com/99designs/gqlgen v0.17.39 h1:wPTAyc2fqVjAWT5DsJ21k/lLudgnXzURwbsjVNegFpU=
+github.com/99designs/gqlgen v0.17.39/go.mod h1:b62q1USk82GYIVjC60h02YguAZLqYZtvWml8KkhJps4=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
@@ -199,8 +199,8 @@ github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/ProtonMail/go-crypto v0.0.0-20230923063757-afb1ddc0824c h1:kMFnB0vCcX7IL/m9Y5LO+KQYv+t1CQOiFe6+SV2J7bE=
 github.com/ProtonMail/go-crypto v0.0.0-20230923063757-afb1ddc0824c/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
-github.com/Yamashou/gqlgenc v0.15.0 h1:FElDbq2BpFBN3wY0hSufQSXJAagJSc2aSMdFvG1BGeA=
-github.com/Yamashou/gqlgenc v0.15.0/go.mod h1:yKaNzczoGrIElG3mG8j2Bg3imv4WyIjLSTRBtvhfMtU=
+github.com/Yamashou/gqlgenc v0.15.1 h1:pva+W/myYSo0f7greV0joKe1wFsRo8tZtI52CWojrhI=
+github.com/Yamashou/gqlgenc v0.15.1/go.mod h1:yKaNzczoGrIElG3mG8j2Bg3imv4WyIjLSTRBtvhfMtU=
 github.com/acomagu/bufpipe v1.0.4 h1:e3H4WUzM3npvo5uv95QuJM3cQspFNtFBzvJ2oNjKIDQ=
 github.com/acomagu/bufpipe v1.0.4/go.mod h1:mxdxdup/WdsKVreO5GpW4+M/1CE2sMG4jeGJ2sYmHc4=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883 h1:bvNMNQO63//z+xNgfBlViaCIJKLlCJ6/fmUseuG0wVQ=
@@ -211,8 +211,8 @@ github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kd
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
 github.com/aws/aws-sdk-go v1.44.122/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
-github.com/aws/aws-sdk-go v1.45.16 h1:spca2z7UJgoQ5V2fX6XiHDCj2E65kOJAfbUPozSkE24=
-github.com/aws/aws-sdk-go v1.45.16/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
+github.com/aws/aws-sdk-go v1.45.25 h1:c4fLlh5sLdK2DCRTY1z0hyuJZU4ygxX8m1FswL6/nF4=
+github.com/aws/aws-sdk-go v1.45.25/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
 github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d h1:xDfNPAt8lFiC1UJrqV3uuy861HCTo708pDMbjHHdCas=
@@ -221,8 +221,8 @@ github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7N
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/charmbracelet/lipgloss v0.8.0 h1:IS00fk4XAHcf8uZKc3eHeMUTCxUH6NkaTrdyCQk84RU=
-github.com/charmbracelet/lipgloss v0.8.0/go.mod h1:p4eYUZZJ/0oXTuCQKFF8mqyKCz0ja6y+7DniDDw5KKU=
+github.com/charmbracelet/lipgloss v0.9.1 h1:PNyd3jvaJbg4jRHKWXnCj1akQm4rh8dbEzN1p/u1KWg=
+github.com/charmbracelet/lipgloss v0.9.1/go.mod h1:1mPmG4cxScwUQALAAnacHaigiiHB9Pmr+v1VEawJl6I=
 github.com/cheggaaa/pb v1.0.27/go.mod h1:pQciLPpbU0oxA0h+VJYYLxO+XeDQb5pZijXscXHm81s=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
@@ -241,8 +241,8 @@ github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWH
 github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cockroachdb/apd/v2 v2.0.2 h1:weh8u7Cneje73dDh+2tEVLUvyBc89iwepWCD8b8034E=
 github.com/cockroachdb/apd/v2 v2.0.2/go.mod h1:DDxRlzC2lo3/vSlmSoS7JkqbbrARPuFOGr0B9pvN3Gw=
-github.com/cpuguy83/go-md2man/v2 v2.0.2 h1:p1EgwI/C7NhT0JmVkwCD2ZBK8j4aeHQX2pMHHBfMQ6w=
-github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cpuguy83/go-md2man/v2 v2.0.3 h1:qMCsGGgs+MAzDFyp9LpAe1Lqy/fY/qCovCm0qnXZOBM=
+github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
 github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
 github.com/cyphar/filepath-securejoin v0.2.4 h1:Ugdm7cg7i6ZK6x3xDF1oEu1nfkyfH53EtKeQYTC3kyg=
@@ -250,8 +250,6 @@ github.com/cyphar/filepath-securejoin v0.2.4/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxG
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dbarrosop/go-toml/v2 v2.0.0-20230603161714-891170c4bf79 h1:a5ywYlQ3hwWPxGTBkfVrdeo9KlDOZ1bXEGOkbYVG53k=
-github.com/dbarrosop/go-toml/v2 v2.0.0-20230603161714-891170c4bf79/go.mod h1:tJU2Z3ZkXwnxa4DPO899bsyIoywizdUvyaeZurnPPDc=
 github.com/elazarl/goproxy v0.0.0-20230808193330-2592e75ae04a h1:mATvB/9r/3gvcejNsXKSkQ6lcIaNec2nyfOdlTBR2lU=
 github.com/elazarl/goproxy v0.0.0-20230808193330-2592e75ae04a/go.mod h1:Ro8st/ElPeALwNFlcTpWmkr6IoMFfkjXAvTHpevnDsM=
 github.com/emicklei/proto v1.11.2 h1:DiIeyTJ+gPSyJI+RIAqvuTeKb0tLUmaGXbYg6aFKsnE=
@@ -334,8 +332,9 @@ github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/martian v2.1.0+incompatible h1:/CP5g8u/VJHijgedC/Legn3BAbAaWPgecwXBIDzw5no=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
 github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
@@ -384,8 +383,8 @@ github.com/googleapis/go-type-adapters v1.0.0/go.mod h1:zHW75FOG2aur7gAO2B+MLby+
 github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-getter v1.7.2 h1:uJDtyXwEfalmp1PqdxuhZqrNkUyClZAhVeZYTArbqkg=
-github.com/hashicorp/go-getter v1.7.2/go.mod h1:W7TalhMmbPmsSMdNjD0ZskARur/9GJ17cfHTRtXV744=
+github.com/hashicorp/go-getter v1.7.3 h1:bN2+Fw9XPFvOCjB0UOevFIMICZ7G2XSQHzfvLUyOM5E=
+github.com/hashicorp/go-getter v1.7.3/go.mod h1:W7TalhMmbPmsSMdNjD0ZskARur/9GJ17cfHTRtXV744=
 github.com/hashicorp/go-safetemp v1.0.0 h1:2HR189eFNrjHQyENnQMMpCiBAsRxzbTMIgBhEyExpmo=
 github.com/hashicorp/go-safetemp v1.0.0/go.mod h1:oaerMy3BhqiTbVye6QuFhFtIceqFoDHxNAB65b+Rj1I=
 github.com/hashicorp/go-version v1.6.0 h1:feTTfFNnjP967rlCxM/I9g701jU+RN74YKx2mOkIeek=
@@ -441,10 +440,16 @@ github.com/muesli/reflow v0.3.0 h1:IFsN6K9NfGtjeggFP+68I4chLZV2yIKsXJFNZ+eWh6s=
 github.com/muesli/reflow v0.3.0/go.mod h1:pbwTDkVPibjO2kyvBQRBxTWEEGDGq0FlB1BIKtnHY/8=
 github.com/muesli/termenv v0.15.2 h1:GohcuySI0QmI3wN8Ok9PtKGkgkFIk7y6Vpb5PvrY+Wo=
 github.com/muesli/termenv v0.15.2/go.mod h1:Epx+iuz8sNs7mNKhxzH4fWXGNpZwUaJKRS1noLXviQ8=
-github.com/nhost/be v0.0.0-20231001065154-f72edc119cf0 h1:cKSejJFrMjUBamyWotU1fTxU8Y7SCvkRL1bt03uMIyA=
-github.com/nhost/be v0.0.0-20231001065154-f72edc119cf0/go.mod h1:TX+opGjg0+Q7LflEByl4E8B8hlu1huf4t2TY3YzUA9c=
+github.com/nhost/be v0.0.0-20231013070532-b96bf777844b h1:8uGuMS1AKAhB809YB9qJ9t+FNCtfVkaxzTUYRw0DoW4=
+github.com/nhost/be v0.0.0-20231013070532-b96bf777844b/go.mod h1:nbGZoyI4xxRGoeEn4XUkBQxK9lVOANSvW4fxIPURHB4=
+github.com/nhost/be v0.0.0-20231018080127-4d94e907dcce h1:qH1/gM9NxnV+AYNvJKfknqhO8QOAFaEBJ0O9d+ZxEuI=
+github.com/nhost/be v0.0.0-20231018080127-4d94e907dcce/go.mod h1:nbGZoyI4xxRGoeEn4XUkBQxK9lVOANSvW4fxIPURHB4=
+github.com/nhost/be v0.0.0-20231018093831-a53b01c2d071 h1:QY5C3CjynnEvxKqs/yvIx7VrZck5jFJPiVRAgSgq8GE=
+github.com/nhost/be v0.0.0-20231018093831-a53b01c2d071/go.mod h1:nbGZoyI4xxRGoeEn4XUkBQxK9lVOANSvW4fxIPURHB4=
 github.com/onsi/gomega v1.27.10 h1:naR28SdDFlqrG6kScpT8VWpu1xWY5nJRCF3XaYyBjhI=
 github.com/onsi/gomega v1.27.10/go.mod h1:RsS8tutOdbdgzbPtzzATp12yT7kM5I5aElG3evPbQ0M=
+github.com/pelletier/go-toml/v2 v2.1.0 h1:FnwAJ4oYMvbT/34k9zzHuZNrhlz48GB3/s6at6/MHO4=
+github.com/pelletier/go-toml/v2 v2.1.0/go.mod h1:tJU2Z3ZkXwnxa4DPO899bsyIoywizdUvyaeZurnPPDc=
 github.com/pjbgf/sha1cd v0.3.0 h1:4D5XXmUUBUl/xQ6IjCkEAbqXskkq/4O7LmGn0AqMDs4=
 github.com/pjbgf/sha1cd v0.3.0/go.mod h1:nZ1rrWOcGJ5uZgEEVL1VUM9iRQiZvWdbZjkKyFzPPsI=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -470,6 +475,8 @@ github.com/sergi/go-diff v1.3.1/go.mod h1:aMJSSKb2lpPvRNec0+w3fl7LP9IOFzdc9Pa4NF
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
 github.com/skeema/knownhosts v1.2.1 h1:SHWdIUa82uGZz+F+47k8SY4QhhI291cXCpopT1lK2AQ=
 github.com/skeema/knownhosts v1.2.1/go.mod h1:xYbVRSPxqBZFrdmDyMmsOs+uX1UZC3nTN3ThzgDxUwo=
+github.com/sosodev/duration v1.2.0 h1:pqK/FLSjsAADWY74SyWDCjOcd5l7H8GSnnOGEB9A1Us=
+github.com/sosodev/duration v1.2.0/go.mod h1:RQIBBX0+fMLc/D9+Jb/fwvVmo0eZvDDEERAikUR6SDg=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
@@ -526,8 +533,8 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.13.0 h1:mvySKfSWJ+UKUii46M40LOvyWfN0s2U+46/jDd0e6Ck=
-golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
+golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc=
+golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -565,8 +572,8 @@ golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=
-golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/mod v0.13.0 h1:I/DsJXRlw/8l/0c24sM9yb0T4z9liZTduXvdAWYiysY=
+golang.org/x/mod v0.13.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -618,8 +625,8 @@ golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.15.0 h1:ugBLEUaxABaB5AJqW9enI0ACdci2RUd4eP51NTBvuJ8=
-golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
+golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
+golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -645,8 +652,8 @@ golang.org/x/oauth2 v0.0.0-20220822191816-0ebed06d0094/go.mod h1:h4gKUeWbJ4rQPri
 golang.org/x/oauth2 v0.0.0-20220909003341-f21342109be1/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
 golang.org/x/oauth2 v0.0.0-20221014153046-6fdb5e3db783/go.mod h1:h4gKUeWbJ4rQPri7E0u6Gs4e9Ri2zaLxzw5DI5XGrYg=
 golang.org/x/oauth2 v0.1.0/go.mod h1:G9FE4dLTsbXUu90h/Pf85g4w1D+SSAgR+q46nJZ8M4A=
-golang.org/x/oauth2 v0.12.0 h1:smVPGxink+n1ZI5pkQa8y6fZT0RW0MgCO5bFpepy4B4=
-golang.org/x/oauth2 v0.12.0/go.mod h1:A74bZ3aGXgCY0qaIC9Ahg6Lglin4AMAco8cIv9baba4=
+golang.org/x/oauth2 v0.13.0 h1:jDDenyj+WgFtmV3zYVoi8aE2BwtXFLWOA67ZfNWftiY=
+golang.org/x/oauth2 v0.13.0/go.mod h1:/JMhi4ZRXAf4HG9LiNmxvk+45+96RUlVThiH8FzNBn0=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -662,8 +669,8 @@ golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.3.0 h1:ftCYgMx6zT/asHUrPw8BLLscYtGznsLAnjq5RH9P66E=
-golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.4.0 h1:zxkM55ReGkDlKSM+Fu41A+zmbZuaPVbGMzvvdUPznYQ=
+golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -734,16 +741,16 @@ golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o=
-golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
+golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.12.0 h1:/ZfYdc3zq+q02Rv9vGqTeSItdzZTSNDmfTi0mBAuidU=
-golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
+golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek=
+golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -815,8 +822,8 @@ golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.13.0 h1:Iey4qkscZuv0VvIt8E0neZjtPVQFSc870HQ448QgEmQ=
-golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
+golang.org/x/tools v0.14.0 h1:jvNa2pY0M4r62jkRQ6RwEZZyPcymeL9XZMLBbV7U2nc=
+golang.org/x/tools v0.14.0/go.mod h1:uYBEerGOWcJyEORxN+Ek8+TT266gXkNlHdJBwexUsBg=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -824,8 +831,9 @@ golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20220411194840-2f41105eb62f/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20220517211312-f3a8303e98df/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
 golang.org/x/xerrors v0.0.0-20220609144429-65e65417b02f/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
-golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 h1:H2TDz8ibqkAF6YGhCdN3jS9O0/s90v0rJh3X/OLHEUk=
 golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
+golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 h1:+cNy6SZtPcJQH3LJVLOSmiC7MMxXNOb3PU/VUEz+EhU=
+golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
 google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
 google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
@@ -874,8 +882,8 @@ google.golang.org/api v0.96.0/go.mod h1:w7wJQLTM+wvQpNf5JyEcBoxK0RH7EDrh/L4qfsuJ
 google.golang.org/api v0.97.0/go.mod h1:w7wJQLTM+wvQpNf5JyEcBoxK0RH7EDrh/L4qfsuJ13s=
 google.golang.org/api v0.98.0/go.mod h1:w7wJQLTM+wvQpNf5JyEcBoxK0RH7EDrh/L4qfsuJ13s=
 google.golang.org/api v0.100.0/go.mod h1:ZE3Z2+ZOr87Rx7dqFsdRQkRBk36kDtp/h+QpHbB7a70=
-google.golang.org/api v0.143.0 h1:o8cekTkqhywkbZT6p1UHJPZ9+9uuCAJs/KYomxZB8fA=
-google.golang.org/api v0.143.0/go.mod h1:FoX9DO9hT7DLNn97OuoZAGSDuNAXdJRuGK98rSUgurk=
+google.golang.org/api v0.147.0 h1:Can3FaQo9LlVqxJCodNmeZW/ib3/qKAY3rFeXiHo5gc=
+google.golang.org/api v0.147.0/go.mod h1:pQ/9j83DcmPd/5C9e2nFOdjjNkDZ1G+zkbK2uvdkJMs=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -986,12 +994,12 @@ google.golang.org/genproto v0.0.0-20221010155953-15ba04fc1c0e/go.mod h1:3526vdqw
 google.golang.org/genproto v0.0.0-20221014173430-6e2ab493f96b/go.mod h1:1vXfmgAz9N9Jx0QA82PqRVauvCz1SGSz739p0f183jM=
 google.golang.org/genproto v0.0.0-20221014213838-99cd37c6964a/go.mod h1:1vXfmgAz9N9Jx0QA82PqRVauvCz1SGSz739p0f183jM=
 google.golang.org/genproto v0.0.0-20221025140454-527a21cfbd71/go.mod h1:9qHF0xnpdSfF6knlcsnpzUu5y+rpwgbvsyGAZPBMg4s=
-google.golang.org/genproto v0.0.0-20230920204549-e6e6cdab5c13 h1:vlzZttNJGVqTsRFU9AmdnrcO1Znh8Ew9kCD//yjigk0=
-google.golang.org/genproto v0.0.0-20230920204549-e6e6cdab5c13/go.mod h1:CCviP9RmpZ1mxVr8MUjCnSiY09IbAXZxhLE6EhHIdPU=
-google.golang.org/genproto/googleapis/api v0.0.0-20230920204549-e6e6cdab5c13 h1:U7+wNaVuSTaUqNvK2+osJ9ejEZxbjHHk8F2b6Hpx0AE=
-google.golang.org/genproto/googleapis/api v0.0.0-20230920204549-e6e6cdab5c13/go.mod h1:RdyHbowztCGQySiCvQPgWQWgWhGnouTdCflKoDBt32U=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230920204549-e6e6cdab5c13 h1:N3bU/SQDCDyD6R528GJ/PwW9KjYcJA3dgyH+MovAkIM=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20230920204549-e6e6cdab5c13/go.mod h1:KSqppvjFjtoCI+KGd4PELB0qLNxdJHRGqRI09mB6pQA=
+google.golang.org/genproto v0.0.0-20231012201019-e917dd12ba7a h1:fwgW9j3vHirt4ObdHoYNwuO24BEZjSzbh+zPaNWoiY8=
+google.golang.org/genproto v0.0.0-20231012201019-e917dd12ba7a/go.mod h1:EMfReVxb80Dq1hhioy0sOsY9jCE46YDgHlJ7fWVUWRE=
+google.golang.org/genproto/googleapis/api v0.0.0-20231012201019-e917dd12ba7a h1:myvhA4is3vrit1a6NZCWBIwN0kNEnX21DJOJX/NvIfI=
+google.golang.org/genproto/googleapis/api v0.0.0-20231012201019-e917dd12ba7a/go.mod h1:SUBoKXbI1Efip18FClrQVGjWcyd0QZd8KkvdP34t7ww=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20231012201019-e917dd12ba7a h1:a2MQQVoTo96JC9PMGtGBymLp7+/RzpFc2yX/9WfFg1c=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20231012201019-e917dd12ba7a/go.mod h1:4cYg8o5yUbm77w8ZX00LhMVNl/YVBFJRYWDc0uYWMs0=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -1027,8 +1035,8 @@ google.golang.org/grpc v1.48.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACu
 google.golang.org/grpc v1.49.0/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
 google.golang.org/grpc v1.50.0/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
 google.golang.org/grpc v1.50.1/go.mod h1:ZgQEeidpAuNRZ8iRrlBKXZQP1ghovWIVhdJRyCDK+GI=
-google.golang.org/grpc v1.58.2 h1:SXUpjxeVF3FKrTYQI4f4KvbGD5u2xccdYdurwowix5I=
-google.golang.org/grpc v1.58.2/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0=
+google.golang.org/grpc v1.58.3 h1:BjnpXut1btbtgN/6sp+brB2Kbm2LjNXnidYujAVbSoQ=
+google.golang.org/grpc v1.58.3/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
diff --git a/nix/overlay.nix b/nix/overlay.nix
index d2f193b8b..7488a4de7 100644
--- a/nix/overlay.nix
+++ b/nix/overlay.nix
@@ -2,11 +2,11 @@
 
   go = prev.go_1_21.overrideAttrs
     (finalAttrs: previousAttrs: rec {
-      version = "1.21.1";
+      version = "1.21.3";
 
       src = final.fetchurl {
         url = "https://go.dev/dl/go${version}.src.tar.gz";
-        sha256 = "sha256-v6Nr916aHpy725q8+dFwfkeb06B4gKiuNWTK7lcRy5k=";
+        sha256 = "sha256-GG8rb4yLcE5paCGwmrIEGlwe4T3LwxVqE63PdZMe5Ig=";
       };
 
     });
diff --git a/vendor/cloud.google.com/go/compute/internal/version.go b/vendor/cloud.google.com/go/compute/internal/version.go
index 639553700..783aa2b95 100644
--- a/vendor/cloud.google.com/go/compute/internal/version.go
+++ b/vendor/cloud.google.com/go/compute/internal/version.go
@@ -15,4 +15,4 @@
 package internal
 
 // Version is the current tagged release of the library.
-const Version = "1.23.0"
+const Version = "1.23.1"
diff --git a/vendor/cloud.google.com/go/iam/CHANGES.md b/vendor/cloud.google.com/go/iam/CHANGES.md
index b8a244178..edcb5b585 100644
--- a/vendor/cloud.google.com/go/iam/CHANGES.md
+++ b/vendor/cloud.google.com/go/iam/CHANGES.md
@@ -1,6 +1,13 @@
 # Changes
 
 
+## [1.1.3](https://github.com/googleapis/google-cloud-go/compare/iam/v1.1.2...iam/v1.1.3) (2023-10-12)
+
+
+### Bug Fixes
+
+* **iam:** Update golang.org/x/net to v0.17.0 ([174da47](https://github.com/googleapis/google-cloud-go/commit/174da47254fefb12921bbfc65b7829a453af6f5d))
+
 ## [1.1.2](https://github.com/googleapis/google-cloud-go/compare/iam/v1.1.1...iam/v1.1.2) (2023-08-08)
 
 
diff --git a/vendor/cloud.google.com/go/iam/apiv1/iampb/iam_policy.pb.go b/vendor/cloud.google.com/go/iam/apiv1/iampb/iam_policy.pb.go
index 3d3e76323..85346a891 100644
--- a/vendor/cloud.google.com/go/iam/apiv1/iampb/iam_policy.pb.go
+++ b/vendor/cloud.google.com/go/iam/apiv1/iampb/iam_policy.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.30.0
+// 	protoc-gen-go v1.31.0
 // 	protoc        v4.23.2
 // source: google/iam/v1/iam_policy.proto
 
diff --git a/vendor/cloud.google.com/go/iam/apiv1/iampb/options.pb.go b/vendor/cloud.google.com/go/iam/apiv1/iampb/options.pb.go
index adc445b07..68f8d761f 100644
--- a/vendor/cloud.google.com/go/iam/apiv1/iampb/options.pb.go
+++ b/vendor/cloud.google.com/go/iam/apiv1/iampb/options.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.30.0
+// 	protoc-gen-go v1.31.0
 // 	protoc        v4.23.2
 // source: google/iam/v1/options.proto
 
diff --git a/vendor/cloud.google.com/go/iam/apiv1/iampb/policy.pb.go b/vendor/cloud.google.com/go/iam/apiv1/iampb/policy.pb.go
index de7995434..eefd1d0e5 100644
--- a/vendor/cloud.google.com/go/iam/apiv1/iampb/policy.pb.go
+++ b/vendor/cloud.google.com/go/iam/apiv1/iampb/policy.pb.go
@@ -14,7 +14,7 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.30.0
+// 	protoc-gen-go v1.31.0
 // 	protoc        v4.23.2
 // source: google/iam/v1/policy.proto
 
diff --git a/vendor/cuelang.org/go/cue/ast/ast.go b/vendor/cuelang.org/go/cue/ast/ast.go
index 8ccc14bc9..6018808ab 100644
--- a/vendor/cuelang.org/go/cue/ast/ast.go
+++ b/vendor/cuelang.org/go/cue/ast/ast.go
@@ -794,7 +794,7 @@ func (x *BasicLit) End() token.Pos { return x.ValuePos.Add(len(x.Value)) }
 func (x *Interpolation) End() token.Pos { return x.Elts[len(x.Elts)-1].Pos() }
 func (x *StructLit) End() token.Pos {
 	if x.Rbrace == token.NoPos && len(x.Elts) > 0 {
-		return x.Elts[len(x.Elts)-1].End()
+		return x.Elts[len(x.Elts)-1].Pos()
 	}
 	return x.Rbrace.Add(1)
 }
diff --git a/vendor/cuelang.org/go/cue/ast/astutil/apply.go b/vendor/cuelang.org/go/cue/ast/astutil/apply.go
index 694ad05f6..22d12c60f 100644
--- a/vendor/cuelang.org/go/cue/ast/astutil/apply.go
+++ b/vendor/cuelang.org/go/cue/ast/astutil/apply.go
@@ -184,6 +184,7 @@ func (c *cursor) Delete()                 { panic("unsupported") }
 //
 // Children are traversed in the order in which they appear in the
 // respective node's struct definition.
+//
 func Apply(node ast.Node, before, after func(Cursor) bool) ast.Node {
 	apply(&applier{before: before, after: after}, nil, &node)
 	return node
@@ -302,6 +303,7 @@ func apply(v applyVisitor, parent Cursor, nodePtr interface{}) {
 // v.Visit(node) is not nil, apply is invoked recursively with visitor
 // w for each of the non-nil children of node, followed by a call of
 // w.Visit(nil).
+//
 func applyCursor(v applyVisitor, c Cursor) {
 	if v = v.Before(c); v == nil {
 		return
diff --git a/vendor/cuelang.org/go/cue/ast/astutil/resolve.go b/vendor/cuelang.org/go/cue/ast/astutil/resolve.go
index 791cad13b..5043e16b2 100644
--- a/vendor/cuelang.org/go/cue/ast/astutil/resolve.go
+++ b/vendor/cuelang.org/go/cue/ast/astutil/resolve.go
@@ -88,6 +88,7 @@ func ResolveExpr(e ast.Expr, errFn ErrFunc) {
 // A Scope maintains the set of named language entities declared
 // in the scope and a link to the immediately surrounding (outer)
 // scope.
+//
 type scope struct {
 	file    *ast.File
 	outer   *scope
@@ -203,9 +204,9 @@ func (s *scope) insert(name string, n, link ast.Node) {
 				if _, ok := existing.node.(*ast.ImportSpec); ok {
 					return
 					// TODO:
-					// s.errFn(n.Pos(), "conflicting declaration %s\n"+
-					// 	"\tprevious declaration at %s",
-					// 	name, existing.node.Pos())
+					s.errFn(n.Pos(), "conflicting declaration %s\n"+
+						"\tprevious declaration at %s",
+						name, existing.node.Pos())
 				} else {
 					s.errFn(n.Pos(), "alias %q redeclared in same scope", name)
 				}
@@ -306,7 +307,7 @@ func (s *scope) Before(n ast.Node) (w visitor) {
 				// references to bind to these illegally.
 				// We need this kind of administration anyway to detect
 				// illegal name clashes, and it allows giving better error
-				// messages. This puts the burden on clients of this library
+				// messages. This puts the burdon on clients of this library
 				// to detect illegal usage, though.
 				name, err := ast.ParseIdent(a.Ident)
 				if err == nil {
diff --git a/vendor/cuelang.org/go/cue/ast/astutil/sanitize.go b/vendor/cuelang.org/go/cue/ast/astutil/sanitize.go
index 8ae3248ce..061a46b6f 100644
--- a/vendor/cuelang.org/go/cue/ast/astutil/sanitize.go
+++ b/vendor/cuelang.org/go/cue/ast/astutil/sanitize.go
@@ -35,9 +35,10 @@ import (
 // construction of an AST.
 //
 // Rewrites:
-//   - auto inserts imports associated with Idents
-//   - unshadows imports associated with idents
-//   - unshadows references for identifiers that were already resolved.
+//    - auto inserts imports associated with Idents
+//    - unshadows imports associated with idents
+//    - unshadows references for identifiers that were already resolved.
+//
 func Sanitize(f *ast.File) error {
 	z := &sanitizer{
 		file: f,
@@ -323,6 +324,7 @@ func (z *sanitizer) handleIdent(s *scope, n *ast.Ident) bool {
 // It prefers short extensions over large ones, while ensuring the likelihood of
 // fast termination is high. There are at least two digits to make it visually
 // clearer this concerns a generated number.
+//
 func (z *sanitizer) uniqueName(base string, hidden bool) string {
 	if hidden && !strings.HasPrefix(base, "_") {
 		base = "_" + base
diff --git a/vendor/cuelang.org/go/cue/ast/astutil/util.go b/vendor/cuelang.org/go/cue/ast/astutil/util.go
index 539d7e325..f6f0ec0e0 100644
--- a/vendor/cuelang.org/go/cue/ast/astutil/util.go
+++ b/vendor/cuelang.org/go/cue/ast/astutil/util.go
@@ -26,10 +26,10 @@ import (
 // ImportPathName derives the package name from the given import path.
 //
 // Examples:
+//      string           string
+//      foo.com/bar      bar
+//      foo.com/bar:baz  baz
 //
-//	string           string
-//	foo.com/bar      bar
-//	foo.com/bar:baz  baz
 func ImportPathName(id string) string {
 	name := path.Base(id)
 	if p := strings.LastIndexByte(name, ':'); p > 0 {
diff --git a/vendor/cuelang.org/go/cue/ast/astutil/walk.go b/vendor/cuelang.org/go/cue/ast/astutil/walk.go
index 8410a913e..2de73d6e9 100644
--- a/vendor/cuelang.org/go/cue/ast/astutil/walk.go
+++ b/vendor/cuelang.org/go/cue/ast/astutil/walk.go
@@ -49,6 +49,7 @@ func walkDeclList(v visitor, list []ast.Decl) {
 // v.Visit(node) is not nil, walk is invoked recursively with visitor
 // w for each of the non-nil children of node, followed by a call of
 // w.Visit(nil).
+//
 func walk(v visitor, node ast.Node) {
 	if v = v.Before(node); v == nil {
 		return
diff --git a/vendor/cuelang.org/go/cue/ast/ident.go b/vendor/cuelang.org/go/cue/ast/ident.go
index 3d81806a7..1f400b286 100644
--- a/vendor/cuelang.org/go/cue/ast/ident.go
+++ b/vendor/cuelang.org/go/cue/ast/ident.go
@@ -129,14 +129,15 @@ func parseIdent(pos token.Pos, ident string) (string, error) {
 //
 // Examples:
 //
-//	Label   Result
-//	foo     "foo"  true   nil
-//	true    "true" true   nil
-//	"foo"   "foo"  false  nil
-//	"x-y"   "x-y"  false  nil
-//	"foo    ""     false  invalid string
-//	"\(x)"  ""     false  errors.Is(err, ErrIsExpression)
-//	X=foo   "foo"  true   nil
+//     Label   Result
+//     foo     "foo"  true   nil
+//     true    "true" true   nil
+//     "foo"   "foo"  false  nil
+//     "x-y"   "x-y"  false  nil
+//     "foo    ""     false  invalid string
+//     "\(x)"  ""     false  errors.Is(err, ErrIsExpression)
+//     X=foo   "foo"  true   nil
+//
 func LabelName(l Label) (name string, isIdent bool, err error) {
 	if a, ok := l.(*Alias); ok {
 		l, _ = a.Expr.(Label)
diff --git a/vendor/cuelang.org/go/cue/ast/walk.go b/vendor/cuelang.org/go/cue/ast/walk.go
index 24a080de6..a23fce454 100644
--- a/vendor/cuelang.org/go/cue/ast/walk.go
+++ b/vendor/cuelang.org/go/cue/ast/walk.go
@@ -24,6 +24,7 @@ import (
 // node must not be nil. If before returns true, Walk invokes f recursively for
 // each of the non-nil children of node, followed by a call of after. Both
 // functions may be nil. If before is nil, it is assumed to always return true.
+//
 func Walk(node Node, before func(Node) bool, after func(Node)) {
 	walk(&inspector{before: before, after: after}, node)
 }
@@ -55,6 +56,7 @@ func walkDeclList(v visitor, list []Decl) {
 // v.Visit(node) is not nil, walk is invoked recursively with visitor
 // w for each of the non-nil children of node, followed by a call of
 // w.Visit(nil).
+//
 func walk(v visitor, node Node) {
 	if v = v.Before(node); v == nil {
 		return
diff --git a/vendor/cuelang.org/go/cue/context.go b/vendor/cuelang.org/go/cue/context.go
index 94187f02f..3da628f58 100644
--- a/vendor/cuelang.org/go/cue/context.go
+++ b/vendor/cuelang.org/go/cue/context.go
@@ -36,7 +36,7 @@ import (
 //
 // Use
 //
-//	ctx := cuecontext.New()
+//    ctx := cuecontext.New()
 //
 // to create a new Context.
 type Context runtime.Runtime
@@ -245,10 +245,7 @@ func (c *Context) CompileBytes(b []byte, options ...BuildOption) Value {
 // }
 
 func (c *Context) make(v *adt.Vertex) Value {
-	opCtx := newContext(c.runtime())
-	x := newValueRoot(c.runtime(), opCtx, v)
-	adt.AddStats(opCtx)
-	return x
+	return newValueRoot(c.runtime(), newContext(c.runtime()), v)
 }
 
 // An EncodeOption defines options for the various encoding-related methods of
@@ -341,9 +338,9 @@ func NilIsAny(isAny bool) EncodeOption {
 // and used as CUE struct field names by applying the following rules, subject
 // to the UTF-8 coercion described for string values above:
 //
-//   - keys of any string type are used directly
-//   - encoding.TextMarshalers are marshaled
-//   - integer keys are converted to strings
+//  - keys of any string type are used directly
+//  - encoding.TextMarshalers are marshaled
+//  - integer keys are converted to strings
 //
 // Pointer values encode as the value pointed to. A nil pointer encodes as the
 // null CUE value.
@@ -355,6 +352,7 @@ func NilIsAny(isAny bool) EncodeOption {
 // Channel, complex, and function values cannot be encoded in CUE. Attempting to
 // encode such a value results in the returned value being an error, accessible
 // through the Err method.
+//
 func (c *Context) Encode(x interface{}, option ...EncodeOption) Value {
 	switch v := x.(type) {
 	case adt.Value:
diff --git a/vendor/cuelang.org/go/cue/cue.go b/vendor/cuelang.org/go/cue/cue.go
index 0dbac258a..6f9622f64 100644
--- a/vendor/cuelang.org/go/cue/cue.go
+++ b/vendor/cuelang.org/go/cue/cue.go
@@ -21,21 +21,23 @@
 // A Context defines the set of active packages, the translations of field
 // names to unique codes, as well as the set of builtins. Use
 //
-//	import "cuelang.org/go/cue/cuecontext"
+//     import "cuelang.org/go/cue/cuecontext"
 //
-//	ctx := cuecontext.New()
+//     ctx := cuecontext.New()
 //
 // to obtain a context.
 //
+//
 // Note that the following types are DEPRECATED and their usage should be
 // avoided if possible:
 //
-//	FieldInfo
-//	Instance
-//	Runtime
-//	Struct
+//    FieldInfo
+//    Instance
+//    Runtime
+//    Struct
 //
 // Many types also have deprecated methods. Code that already uses deprecated
 // methods can keep using them for at least some time. We aim to provide a
 // go or cue fix solution to automatically rewrite code using the new API.
+//
 package cue
diff --git a/vendor/cuelang.org/go/cue/decode.go b/vendor/cuelang.org/go/cue/decode.go
index 8b9743d11..f4adc5bd1 100644
--- a/vendor/cuelang.org/go/cue/decode.go
+++ b/vendor/cuelang.org/go/cue/decode.go
@@ -740,9 +740,8 @@ func (o tagOptions) Contains(optionName string) bool {
 // 4) simpleLetterEqualFold, no specials, no non-letters.
 //
 // The letters S and K are special because they map to 3 runes, not just 2:
-//   - S maps to s and to U+017F 'ſ' Latin small letter long s
-//   - k maps to K and to U+212A 'K' Kelvin sign
-//
+//  * S maps to s and to U+017F 'ſ' Latin small letter long s
+//  * k maps to K and to U+212A 'K' Kelvin sign
 // See https://play.golang.org/p/tTxjOc0OGo
 //
 // The returned function is specialized for matching against s and
diff --git a/vendor/cuelang.org/go/cue/errors/errors.go b/vendor/cuelang.org/go/cue/errors/errors.go
index 29141a5d9..af5038c22 100644
--- a/vendor/cuelang.org/go/cue/errors/errors.go
+++ b/vendor/cuelang.org/go/cue/errors/errors.go
@@ -254,7 +254,7 @@ func Promote(err error, msg string) Error {
 	case Error:
 		return x
 	default:
-		return Wrapf(err, token.NoPos, "%s", msg)
+		return Wrapf(err, token.NoPos, msg)
 	}
 }
 
@@ -293,16 +293,13 @@ func Append(a, b Error) Error {
 // its individual elements. If the given error is not an Error, it will be
 // promoted to one.
 func Errors(err error) []Error {
-	if err == nil {
+	switch x := err.(type) {
+	case nil:
 		return nil
-	}
-	var listErr list
-	var errorErr Error
-	switch {
-	case As(err, &listErr):
-		return listErr
-	case As(err, &errorErr):
-		return []Error{errorErr}
+	case list:
+		return []Error(x)
+	case Error:
+		return []Error{x}
 	default:
 		return []Error{Promote(err, "")}
 	}
@@ -326,7 +323,7 @@ func appendToList(a list, err Error) list {
 // The zero value for an list is an empty list ready to use.
 type list []Error
 
-func (p list) Is(target error) bool {
+func (p list) Is(err, target error) bool {
 	for _, e := range p {
 		if errors.Is(e, target) {
 			return true
@@ -335,7 +332,7 @@ func (p list) Is(target error) bool {
 	return false
 }
 
-func (p list) As(target interface{}) bool {
+func (p list) As(err error, target interface{}) bool {
 	for _, e := range p {
 		if errors.As(e, target) {
 			return true
@@ -423,33 +420,20 @@ func equalPath(a, b []string) bool {
 // Sanitize sorts multiple errors and removes duplicates on a best effort basis.
 // If err represents a single or no error, it returns the error as is.
 func Sanitize(err Error) Error {
-	if err == nil {
-		return nil
-	}
-	if l, ok := err.(list); ok {
-		a := l.sanitize()
-		if len(a) == 1 {
-			return a[0]
-		}
+	if l, ok := err.(list); ok && err != nil {
+		a := make(list, len(l))
+		copy(a, l)
+		a.Sort()
+		a.RemoveMultiples()
 		return a
 	}
 	return err
 }
 
-func (p list) sanitize() list {
-	if p == nil {
-		return p
-	}
-	a := make(list, len(p))
-	copy(a, p)
-	a.Sort()
-	a.RemoveMultiples()
-	return a
-}
-
 // Sort sorts an List. *posError entries are sorted by position,
 // other errors are sorted by error message, and before any *posError
 // entry.
+//
 func (p list) Sort() {
 	sort.Sort(p)
 }
@@ -477,7 +461,6 @@ func approximateEqual(a, b Error) bool {
 	}
 	return aPos.Filename() == bPos.Filename() &&
 		aPos.Line() == bPos.Line() &&
-		aPos.Column() == bPos.Column() &&
 		equalPath(a.Path(), b.Path())
 }
 
@@ -548,11 +531,15 @@ type Config struct {
 // Print is a utility function that prints a list of errors to w,
 // one error per line, if the err parameter is an List. Otherwise
 // it prints the err string.
+//
 func Print(w io.Writer, err error, cfg *Config) {
 	if cfg == nil {
 		cfg = &Config{}
 	}
-	for _, e := range list(Errors(err)).sanitize() {
+	if e, ok := err.(Error); ok {
+		err = Sanitize(e)
+	}
+	for _, e := range Errors(err) {
 		printError(w, e, cfg)
 	}
 }
@@ -583,9 +570,8 @@ func writeErr(w io.Writer, err Error) {
 
 		printed := false
 		msg, args := err.Msg()
-		s := fmt.Sprintf(msg, args...)
-		if s != "" || u == nil { // print at least something
-			_, _ = io.WriteString(w, s)
+		if msg != "" || u == nil { // print at least something
+			fmt.Fprintf(w, msg, args...)
 			printed = true
 		}
 
diff --git a/vendor/cuelang.org/go/cue/format.go b/vendor/cuelang.org/go/cue/format.go
index 0f7812d19..707a7990e 100644
--- a/vendor/cuelang.org/go/cue/format.go
+++ b/vendor/cuelang.org/go/cue/format.go
@@ -33,35 +33,35 @@ import (
 
 // Format prints a CUE value.
 //
-// WARNING: although we are narrowing down the semantics, the verbs and options
-// are still subject to change. this API is experimental although it is likely
-// getting close to the final design.
+// WARNING:
+//     although we are narrowing down the semantics, the verbs and options
+//     are still subject to change. this API is experimental although it is
+//     likely getting close to the final design.
 //
 // It recognizes the following verbs:
 //
-//	v    print CUE value
+//     v    print CUE value
 //
 // The verbs support the following flags:
-//
-//	#    print as schema and include definitions.
-//	     The result is printed as a self-contained file, instead of an the
-//	     expression format.
-//	+    evaluate: resolve defaults and error on incomplete errors
+//     #    print as schema and include definitions.
+//          The result is printed as a self-contained file, instead of an the
+//          expression format.
+//     +    evaluate: resolve defaults and error on incomplete errors
 //
 // Indentation can be controlled as follows:
-//
-//	width      indent the cue block by <width> tab stops (e.g. %2v)
-//	precision  convert tabs to <precision> spaces (e.g. %.2v), where
-//	           a value of 0 means no indentation or newlines (TODO).
+//     width      indent the cue block by <width> tab stops (e.g. %2v)
+//     precision  convert tabs to <precision> spaces (e.g. %.2v), where
+//                a value of 0 means no indentation or newlines (TODO).
 //
 // If the value kind corresponds to one of the following Go types, the
 // usual Go formatting verbs for that type can be used:
 //
-//	Int:          b,d,o,O,q,x,X
-//	Float:        f,e,E,g,G
-//	String/Bytes: s,q,x,X
+//     Int:          b,d,o,O,q,x,X
+//     Float:        f,e,E,g,G
+//     String/Bytes: s,q,x,X
 //
 // The %v directive will be used if the type is not supported for that verb.
+//
 func (v Value) Format(state fmt.State, verb rune) {
 	if v.v == nil {
 		fmt.Fprint(state, "<nil>")
diff --git a/vendor/cuelang.org/go/cue/format/format.go b/vendor/cuelang.org/go/cue/format/format.go
index cd1d460f5..5e81eb359 100644
--- a/vendor/cuelang.org/go/cue/format/format.go
+++ b/vendor/cuelang.org/go/cue/format/format.go
@@ -87,6 +87,7 @@ func sortImportsOption() Option {
 //
 // The function may return early (before the entire result is written) and
 // return a formatting error, for instance due to an incorrect AST.
+//
 func Node(node ast.Node, opt ...Option) ([]byte, error) {
 	cfg := newConfig(opt)
 	return cfg.fprint(node)
@@ -104,6 +105,7 @@ func Node(node ast.Node, opt ...Option) ([]byte, error) {
 // Caution: Tools relying on consistent formatting based on the installed
 // version of cue (for instance, such as for presubmit checks) should execute
 // that cue binary instead of calling Source.
+//
 func Source(b []byte, opt ...Option) ([]byte, error) {
 	cfg := newConfig(opt)
 
@@ -253,6 +255,7 @@ func (f *formatter) print(a ...interface{}) {
 			f.current.pos++
 		}
 	}
+	f.visitComments(f.current.pos)
 }
 
 func (f *formatter) formfeed() whiteSpace {
diff --git a/vendor/cuelang.org/go/cue/format/node.go b/vendor/cuelang.org/go/cue/format/node.go
index d5da39632..6d06ae412 100644
--- a/vendor/cuelang.org/go/cue/format/node.go
+++ b/vendor/cuelang.org/go/cue/format/node.go
@@ -812,7 +812,6 @@ func reduceDepth(depth int) int {
 // (Algorithm suggestion by Russ Cox.)
 //
 // The precedences are:
-//
 //	7             *  /  % quo rem div mod
 //	6             +  -
 //	5             ==  !=  <  <=  >  >=
@@ -827,22 +826,23 @@ func reduceDepth(depth int) int {
 // To choose the cutoff, look at the whole expression but excluding primary
 // expressions (function calls, parenthesized exprs), and apply these rules:
 //
-//  1. If there is a binary operator with a right side unary operand
-//     that would clash without a space, the cutoff must be (in order):
+//	1) If there is a binary operator with a right side unary operand
+//	   that would clash without a space, the cutoff must be (in order):
+//
+//		/*	8
+//		++	7 // not necessary, but to avoid confusion
+//		--	7
 //
-//     /*	8
-//     ++	7 // not necessary, but to avoid confusion
-//     --	7
+//         (Comparison operators always have spaces around them.)
 //
-//     (Comparison operators always have spaces around them.)
+//	2) If there is a mix of level 7 and level 6 operators, then the cutoff
+//	   is 7 (use spaces to distinguish precedence) in Normal mode
+//	   and 6 (never use spaces) in Compact mode.
 //
-//  2. If there is a mix of level 7 and level 6 operators, then the cutoff
-//     is 7 (use spaces to distinguish precedence) in Normal mode
-//     and 6 (never use spaces) in Compact mode.
+//	3) If there are no level 6 operators or no level 7 operators, then the
+//	   cutoff is 8 (always use spaces) in Normal mode
+//	   and 6 (never use spaces) in Compact mode.
 //
-//  3. If there are no level 6 operators or no level 7 operators, then the
-//     cutoff is 8 (always use spaces) in Normal mode
-//     and 6 (never use spaces) in Compact mode.
 func (f *formatter) binaryExpr(x *ast.BinaryExpr, prec1, cutoff, depth int) {
 	f.nestExpr++
 	defer func() { f.nestExpr-- }()
diff --git a/vendor/cuelang.org/go/cue/format/printer.go b/vendor/cuelang.org/go/cue/format/printer.go
index 3e02ca637..a43154fa6 100644
--- a/vendor/cuelang.org/go/cue/format/printer.go
+++ b/vendor/cuelang.org/go/cue/format/printer.go
@@ -173,9 +173,6 @@ func (p *printer) Print(v interface{}) {
 		p.lastTok = token.IDENT
 
 	case string:
-		// We can print a Go string as part of a CUE identifier or literal;
-		// for example, see the formatter.label method.
-		isLit = true
 		data = x
 		impliedComma = true
 		p.lastTok = token.STRING
@@ -197,14 +194,12 @@ func (p *printer) Print(v interface{}) {
 		return
 
 	case *ast.Attribute:
-		isLit = true
 		data = x.Text
 		impliedComma = true
 		p.lastTok = token.ATTRIBUTE
 
 	case *ast.Comment:
 		// TODO: if implied comma, postpone comment
-		isLit = true
 		data = x.Text
 		p.lastTok = token.COMMENT
 
@@ -344,6 +339,7 @@ func (f *formatter) matchUnindent() whiteSpace {
 // needed (i.e., when we don't know that s contains no tabs or line breaks)
 // avoids processing extra escape characters and reduces run time of the
 // printer benchmark by up to 10%.
+//
 func (p *printer) writeString(s string, isLit bool) {
 	if s != "" {
 		p.spaceBefore = false
diff --git a/vendor/cuelang.org/go/cue/instance.go b/vendor/cuelang.org/go/cue/instance.go
index 3eeebf0d7..0fe93c49f 100644
--- a/vendor/cuelang.org/go/cue/instance.go
+++ b/vendor/cuelang.org/go/cue/instance.go
@@ -210,11 +210,6 @@ func (inst *hiddenInstance) Doc() []*ast.CommentGroup {
 func (inst *Instance) Value() Value {
 	ctx := newContext(inst.index)
 	inst.root.Finalize(ctx)
-	// TODO: consider including these statistics as well. Right now, this only
-	// seems to be used in cue cmd for "auxiliary" evaluations, like filetypes.
-	// These arguably skew the actual statistics for the cue command line, so
-	// it is convenient to not include these.
-	// adt.AddStats(ctx)
 	return newVertexRoot(inst.index, ctx, inst.root)
 }
 
@@ -242,7 +237,7 @@ func Merge(inst ...*Instance) *Instance {
 
 	for _, i := range inst {
 		w := i.Value()
-		v.AddConjunct(adt.MakeRootConjunct(nil, w.v.ToDataAll(ctx)))
+		v.AddConjunct(adt.MakeRootConjunct(nil, w.v.ToDataAll()))
 	}
 	v.Finalize(ctx)
 
diff --git a/vendor/cuelang.org/go/cue/literal/string.go b/vendor/cuelang.org/go/cue/literal/string.go
index 5742ce4c3..59fae0a60 100644
--- a/vendor/cuelang.org/go/cue/literal/string.go
+++ b/vendor/cuelang.org/go/cue/literal/string.go
@@ -29,8 +29,7 @@ var (
 	errUnmatchedQuote = errors.New("invalid string: unmatched quote")
 	// TODO: making this an error is optional according to RFC 4627. But we
 	// could make it not an error if this ever results in an issue.
-	errSurrogate          = errors.New("unmatched surrogate pair")
-	errEscapedLastNewline = errors.New("last newline of multiline string cannot be escaped")
+	errSurrogate = errors.New("unmatched surrogate pair")
 )
 
 // Unquote interprets s as a single- or double-quoted, single- or multi-line
@@ -136,8 +135,7 @@ func ParseQuotes(start, end string) (q QuoteInfo, nStart, nEnd int, err error) {
 	return q, nStart, int(q.numChar) + q.numHash, nil
 }
 
-// Unquote unquotes the given string, which should not contain
-// the initial quote character(s). It must be terminated with a quote or an
+// Unquote unquotes the given string. It must be terminated with a quote or an
 // interpolation start. Escape sequences are expanded and surrogates
 // are replaced with the corresponding non-surrogate code points.
 func (q QuoteInfo) Unquote(s string) (string, error) {
@@ -157,21 +155,23 @@ func (q QuoteInfo) Unquote(s string) (string, error) {
 	var runeTmp [utf8.UTFMax]byte
 	buf := make([]byte, 0, 3*len(s)/2) // Try to avoid more allocations.
 	stripNL := false
-	wasEscapedNewline := false
 	for len(s) > 0 {
 		switch s[0] {
 		case '\r':
 			s = s[1:]
-			wasEscapedNewline = false
 			continue
 		case '\n':
-			var err error
-			s, err = skipWhitespaceAfterNewline(s[1:], q)
-			if err != nil {
-				return "", err
+			switch {
+			case !q.multiline:
+				fallthrough
+			default:
+				return "", errInvalidWhitespace
+			case strings.HasPrefix(s[1:], q.whitespace):
+				s = s[1+len(q.whitespace):]
+			case strings.HasPrefix(s[1:], "\n"):
+				s = s[1:]
 			}
 			stripNL = true
-			wasEscapedNewline = false
 			buf = append(buf, '\n')
 			continue
 		}
@@ -194,32 +194,17 @@ func (q QuoteInfo) Unquote(s string) (string, error) {
 
 		s = ss
 		if c < 0 {
-			switch c {
-			case escapedNewline:
-				var err error
-				s, err = skipWhitespaceAfterNewline(s, q)
-				if err != nil {
-					return "", err
-				}
-				wasEscapedNewline = true
-				continue
-			case terminatedByQuote:
-				if wasEscapedNewline {
-					return "", errEscapedLastNewline
-				}
-				if stripNL {
-					// Strip the last newline, but only if it came from a closing
-					// quote.
-					buf = buf[:len(buf)-1]
-				}
-			case terminatedByExpr:
-			default:
-				panic("unreachable")
+			if c == -2 {
+				stripNL = false
+			}
+			if stripNL {
+				// Strip the last newline, but only if it came from a closing
+				// quote.
+				buf = buf[:len(buf)-1]
 			}
 			return string(buf), nil
 		}
 		stripNL = false
-		wasEscapedNewline = false
 		if c < utf8.RuneSelf || !multibyte {
 			buf = append(buf, byte(c))
 		} else {
@@ -231,22 +216,6 @@ func (q QuoteInfo) Unquote(s string) (string, error) {
 	return "", errUnmatchedQuote
 }
 
-func skipWhitespaceAfterNewline(s string, q QuoteInfo) (string, error) {
-	switch {
-	case !q.multiline:
-		// Can't happen because Unquote does an initial check for literal newlines
-		// in the non-multiline case, but be defensive.
-		fallthrough
-	default:
-		return "", errInvalidWhitespace
-	case strings.HasPrefix(s, q.whitespace):
-		s = s[len(q.whitespace):]
-	case strings.HasPrefix(s, "\n"):
-	case strings.HasPrefix(s, "\r\n"):
-	}
-	return s, nil
-}
-
 const (
 	surHigh = 0xD800
 	surLow  = 0xDC00
@@ -278,23 +247,14 @@ func contains(s string, c byte) bool {
 	return false
 }
 
-const (
-	terminatedByQuote = rune(-1)
-	terminatedByExpr  = rune(-2)
-	escapedNewline    = rune(-3)
-)
-
 // unquoteChar decodes the first character or byte in the escaped string.
 // It returns four values:
 //
-//  1. value, the decoded Unicode code point or byte value if non-negative, or
-//     one of the following special values:
-//     - terminatedByQuote indicates terminated by quotes
-//     - terminatedByExpr means terminated by \(
-//     - escapedNewline means that the line-termination character was quoted and should be omitted
-//  2. multibyte, a boolean indicating whether the decoded character requires a multibyte UTF-8 representation;
-//  3. tail, the remainder of the string after the character; and
-//  4. an error that will be nil if the character is syntactically valid.
+//	1) value, the decoded Unicode code point or byte value; the special value
+//     of -1 indicates terminated by quotes and -2 means terminated by \(.
+//	2) multibyte, a boolean indicating whether the decoded character requires a multibyte UTF-8 representation;
+//	3) tail, the remainder of the string after the character; and
+//	4) an error that will be nil if the character is syntactically valid.
 //
 // The second argument, kind, specifies the type of literal being parsed
 // and therefore which kind of escape sequences are permitted.
@@ -321,7 +281,7 @@ func unquoteChar(s string, info QuoteInfo) (value rune, multibyte bool, tail str
 			// TODO: terminating quote in middle of string
 			return 0, false, s[ln:], errSyntax
 		}
-		return terminatedByQuote, false, "", nil
+		return -1, false, "", nil
 	case c >= utf8.RuneSelf:
 		// TODO: consider handling surrogate values. These are discarded by
 		// DecodeRuneInString. It is technically correct to disallow it, but
@@ -438,16 +398,7 @@ func unquoteChar(s string, info QuoteInfo) (value rune, multibyte bool, tail str
 			// TODO: terminating quote in middle of string
 			return 0, false, s, errSyntax
 		}
-		value = terminatedByExpr
-	case '\r':
-		if len(s) == 0 || s[0] != '\n' {
-			err = errSyntax
-			return
-		}
-		s = s[1:]
-		value = escapedNewline
-	case '\n':
-		value = escapedNewline
+		value = -2
 	default:
 		err = errSyntax
 		return
diff --git a/vendor/cuelang.org/go/cue/marshal.go b/vendor/cuelang.org/go/cue/marshal.go
index dabf86d98..43ca6d463 100644
--- a/vendor/cuelang.org/go/cue/marshal.go
+++ b/vendor/cuelang.org/go/cue/marshal.go
@@ -95,8 +95,8 @@ func compileInstances(r *Runtime, data []*instanceData) (instances []*Instance,
 	return r.build(builds)
 }
 
-// Unmarshal returns a slice of instances from bytes generated by
-// Runtime.Marshal.
+// Unmarshal creates an Instance from bytes generated by the MarshalBinary
+// method of an instance.
 func (r *Runtime) Unmarshal(b []byte) ([]*Instance, error) {
 	if len(b) == 0 {
 		return nil, errors.Newf(token.NoPos, "unmarshal failed: empty buffer")
diff --git a/vendor/cuelang.org/go/cue/parser/interface.go b/vendor/cuelang.org/go/cue/parser/interface.go
index 2248f1edf..8695a6c34 100644
--- a/vendor/cuelang.org/go/cue/parser/interface.go
+++ b/vendor/cuelang.org/go/cue/parser/interface.go
@@ -21,7 +21,6 @@ import (
 	"cuelang.org/go/cue/ast/astutil"
 	"cuelang.org/go/cue/errors"
 	"cuelang.org/go/cue/token"
-	"cuelang.org/go/internal"
 	"cuelang.org/go/internal/source"
 )
 
@@ -84,6 +83,10 @@ func FromVersion(version int) Option {
 	return func(p *parser) { p.version = version }
 }
 
+func version0(minor, patch int) int {
+	return -1000 + 100*minor + patch
+}
+
 // DeprecationError is a sentinel error to indicate that an error is
 // related to an unsupported old CUE syntax.
 type DeprecationError struct {
@@ -94,19 +97,11 @@ func (e *DeprecationError) Error() string {
 	return "try running `cue fix` (possibly with an earlier version, like v0.2.2) to upgrade"
 }
 
-const (
-	// Latest specifies the latest version of the parser, effectively setting
-	// the strictest implementation.
-	Latest = latest
-
-	latest = -1000 + (100 * internal.MinorCurrent) + 0
-
-	// FullBackwardCompatibility enables all deprecated features that are
-	// currently still supported by the parser.
-	FullBackwardCompatibility = fullCompatibility
+// Latest specifies the latest version of the parser, effectively setting
+// the strictest implementation.
+const Latest = latest
 
-	fullCompatibility = -1000
-)
+const latest = -600
 
 // FileOffset specifies the File position info to use.
 func FileOffset(pos int) Option {
diff --git a/vendor/cuelang.org/go/cue/parser/parser.go b/vendor/cuelang.org/go/cue/parser/parser.go
index c02155137..e91b3014e 100644
--- a/vendor/cuelang.org/go/cue/parser/parser.go
+++ b/vendor/cuelang.org/go/cue/parser/parser.go
@@ -24,7 +24,6 @@ import (
 	"cuelang.org/go/cue/literal"
 	"cuelang.org/go/cue/scanner"
 	"cuelang.org/go/cue/token"
-	"cuelang.org/go/internal"
 	"cuelang.org/go/internal/astinternal"
 )
 
@@ -394,12 +393,8 @@ func (p *parser) next() {
 // assertV0 indicates the last version at which a certain feature was
 // supported.
 func (p *parser) assertV0(pos token.Pos, minor, patch int, name string) {
-	v := internal.Version(minor, patch)
-	base := p.version
-	if base == 0 {
-		base = internal.APIVersionSupported
-	}
-	if base > v {
+	v := version0(minor, patch)
+	if p.version != 0 && p.version > v {
 		p.errors = errors.Append(p.errors,
 			errors.Wrapf(&DeprecationError{v}, pos,
 				"use of deprecated %s (deprecated as of v0.%d.%d)", name, minor, patch+1))
diff --git a/vendor/cuelang.org/go/cue/path.go b/vendor/cuelang.org/go/cue/path.go
index cda48f54a..805410784 100644
--- a/vendor/cuelang.org/go/cue/path.go
+++ b/vendor/cuelang.org/go/cue/path.go
@@ -16,7 +16,6 @@ package cue
 
 import (
 	"fmt"
-	"math/bits"
 	"strconv"
 	"strings"
 
@@ -30,87 +29,6 @@ import (
 	"github.com/cockroachdb/apd/v2"
 )
 
-// SelectorType represents the kind of a selector. It indicates both the label
-// type as well as whether it is a constraint or an actual value.
-type SelectorType uint16
-
-const (
-	// StringLabel represents a regular non-definition field.
-	StringLabel SelectorType = 1 << iota
-	// IndexLabel represents a numeric index into an array.
-	IndexLabel
-	// DefinitionLabel represents a definition.
-	DefinitionLabel
-	// HiddenLabel represents a hidden non-definition field.
-	HiddenLabel
-	// HiddenDefinitionLabel represents a hidden definition.
-	HiddenDefinitionLabel
-
-	// OptionalConstraint represents an optional constraint (?).
-	OptionalConstraint
-	// PatternConstraint represents a selector of fields in a struct
-	// or array that match a constraint.
-	PatternConstraint
-
-	InvalidSelectorType SelectorType = 0
-)
-
-// LabelType reports the label type of t.
-func (t SelectorType) LabelType() SelectorType {
-	return t & 0b0001_1111
-}
-
-// ConstraintType reports the constraint type of t.
-func (t SelectorType) ConstraintType() SelectorType {
-	return t & 0b0110_0000
-}
-
-var selectorTypeStrings = [...]string{
-	"InvalidSelectorType",
-	"StringLabel",
-	"IndexLabel",
-	"DefinitionLabel",
-	"HiddenLabel",
-	"HiddenDefinitionLabel",
-	"OptionalConstraint",
-	"PatternConstraint",
-}
-
-func (t SelectorType) String() string {
-	if t.LabelType() == 0 && t.ConstraintType() == 0 {
-		return "NoLabels"
-	}
-	single := bits.OnesCount16(uint16(t)) == 1
-	var buf strings.Builder
-	for i := range selectorTypeStrings[:len(selectorTypeStrings)-1] {
-		if t&(SelectorType(1)<<i) == 0 {
-			continue
-		}
-		if single {
-			return selectorTypeStrings[i+1]
-		}
-		if buf.Len() > 0 {
-			buf.WriteByte('|')
-		}
-		buf.WriteString(selectorTypeStrings[i+1])
-	}
-	return buf.String()
-}
-
-// IsHidden reports whether t describes a hidden field, regardless of
-// whether or not this is a constraint.
-func (t SelectorType) IsHidden() bool {
-	t = t.LabelType()
-	return t == HiddenLabel || t == HiddenDefinitionLabel
-}
-
-// IsDefinition reports whether t describes a definition, regardless of
-// whether or not this is a constraint.
-func (t SelectorType) IsDefinition() bool {
-	t = t.LabelType()
-	return t == HiddenDefinitionLabel || t == DefinitionLabel
-}
-
 // A Selector is a component of a path.
 type Selector struct {
 	sel selector
@@ -121,72 +39,21 @@ func (sel Selector) String() string {
 	return sel.sel.String()
 }
 
-// Unquoted returns the unquoted value of a string label.
-// It panics unless sel.LabelType is StringLabel and has a concrete name.
-func (sel Selector) Unquoted() string {
-	if sel.LabelType() != StringLabel ||
-		sel.ConstraintType() >= PatternConstraint {
-		panic("Selector.Unquoted invoked on non-string label")
-	}
-	switch s := sel.sel.(type) {
-	case stringSelector:
-		return string(s)
-	case optionalSelector:
-		return string(s.selector.(stringSelector))
-	}
-	panic(fmt.Sprintf("unreachable %T", sel.sel))
-}
-
-// IsConstraint reports whether s is optional or a pattern constraint.
-// Fields that are constraints are considered non-existing and their
-// values may be erroneous for a configuration to be valid..
-func (sel Selector) IsConstraint() bool {
-	return sel.Type().ConstraintType() != 0
-}
-
-// IsString reports whether sel represents an optional or regular member field.
+// IsString reports whether sel is a regular label type.
 func (sel Selector) IsString() bool {
-	// TODO: consider deprecating this method. It is a bit wonkey now.
-	t := sel.Type()
-	t &^= OptionalConstraint
-	return t == StringLabel
+	return sel.sel.kind() == adt.StringLabel
 }
 
-// IsDefinition reports whether sel is a non-hidden definition and non-constraint label type.
+// IsDefinition reports whether sel is a non-hidden definition label type.
 func (sel Selector) IsDefinition() bool {
-	return sel.Type().IsDefinition()
-}
-
-// Type returns the type of the selector.
-func (sel Selector) Type() SelectorType {
-	return sel.sel.labelType() | sel.sel.constraintType()
-}
-
-// LabelType returns the type of the label part of a selector.
-func (sel Selector) LabelType() SelectorType {
-	return sel.sel.labelType()
-}
-
-// ConstraintType returns the type of the constraint part of a selector.
-func (sel Selector) ConstraintType() SelectorType {
-	return sel.sel.constraintType()
+	return sel.sel.kind() == adt.DefinitionLabel
 }
 
 // PkgPath reports the package path associated with a hidden label or "" if
 // this is not a hidden label.
 func (sel Selector) PkgPath() string {
-	s, _ := sel.sel.(scopedSelector)
-	return s.pkg
-}
-
-// Index returns the index of the selector. It panics
-// unless sel.Type is SelIndex.
-func (sel Selector) Index() int {
-	s, ok := sel.sel.(indexSelector)
-	if !ok {
-		panic("Index called on non-index selector")
-	}
-	return adt.Feature(s).Index()
+	h, _ := sel.sel.(scopedSelector)
+	return h.pkg
 }
 
 var (
@@ -196,6 +63,7 @@ var (
 	// In paths it is used to select constraints that apply to all elements.
 	// AnyDefinition = anyDefinition
 	anyDefinition = Selector{sel: anySelector(adt.AnyDefinition)}
+
 	// AnyIndex can be used to ask for any index.
 	//
 	// In paths it is used to select constraints that apply to all elements.
@@ -210,9 +78,7 @@ var (
 )
 
 // Optional converts sel into an optional equivalent.
-// It's a no-op if the selector is already optional.
-//
-//	foo -> foo?
+//     foo -> foo?
 func (sel Selector) Optional() Selector {
 	return wrapOptional(sel)
 }
@@ -221,8 +87,7 @@ type selector interface {
 	String() string
 
 	feature(ctx adt.Runtime) adt.Feature
-	labelType() SelectorType
-	constraintType() SelectorType
+	kind() adt.FeatureType
 	optional() bool
 }
 
@@ -263,7 +128,7 @@ func ParsePath(s string) Path {
 
 	p := Path{path: toSelectors(expr)}
 	for _, sel := range p.path {
-		if sel.Type().IsHidden() {
+		if sel.sel.kind().IsHidden() {
 			return MakePath(Selector{pathError{errors.Newf(token.NoPos,
 				"invalid path: hidden fields not allowed in path %s", s)}})
 		}
@@ -284,25 +149,27 @@ func (p Path) String() string {
 
 	b := &strings.Builder{}
 	for i, sel := range p.path {
+		x := sel.sel
+		// TODO: use '.' in all cases, once supported.
+		_, isAny := x.(anySelector)
 		switch {
-		case sel.Type() == IndexLabel:
-			// TODO: use '.' in all cases, once supported.
+		case x.kind() == adt.IntLabel && !isAny:
 			b.WriteByte('[')
-			b.WriteString(sel.sel.String())
+			b.WriteString(x.String())
 			b.WriteByte(']')
 			continue
 		case i > 0:
 			b.WriteByte('.')
 		}
 
-		b.WriteString(sel.sel.String())
+		b.WriteString(x.String())
 	}
 	return b.String()
 }
 
 // Optional returns the optional form of a Path. For instance,
+//    foo.bar  --> foo?.bar?
 //
-//	foo.bar  --> foo?.bar?
 func (p Path) Optional() Path {
 	q := make([]Selector, 0, len(p.path))
 	for _, s := range p.path {
@@ -462,13 +329,18 @@ func (s scopedSelector) String() string {
 }
 func (scopedSelector) optional() bool { return false }
 
-func (s scopedSelector) labelType() SelectorType {
-	if strings.HasPrefix(s.name, "_#") {
-		return HiddenDefinitionLabel
+func (s scopedSelector) kind() adt.FeatureType {
+	switch {
+	case strings.HasPrefix(s.name, "#"):
+		return adt.DefinitionLabel
+	case strings.HasPrefix(s.name, "_#"):
+		return adt.HiddenDefinitionLabel
+	case strings.HasPrefix(s.name, "_"):
+		return adt.HiddenLabel
+	default:
+		return adt.StringLabel
 	}
-	return HiddenLabel
 }
-func (s scopedSelector) constraintType() SelectorType { return 0 }
 
 func (s scopedSelector) feature(r adt.Runtime) adt.Feature {
 	return adt.MakeIdentLabel(r, s.name, s.pkg)
@@ -496,12 +368,10 @@ func (d definitionSelector) String() string {
 
 func (d definitionSelector) optional() bool { return false }
 
-func (d definitionSelector) labelType() SelectorType {
-	return DefinitionLabel
+func (d definitionSelector) kind() adt.FeatureType {
+	return adt.DefinitionLabel
 }
 
-func (s definitionSelector) constraintType() SelectorType { return 0 }
-
 func (d definitionSelector) feature(r adt.Runtime) adt.Feature {
 	return adt.MakeIdentLabel(r, string(d), "")
 }
@@ -521,9 +391,8 @@ func (s stringSelector) String() string {
 	return str
 }
 
-func (s stringSelector) optional() bool               { return false }
-func (s stringSelector) labelType() SelectorType      { return StringLabel }
-func (s stringSelector) constraintType() SelectorType { return 0 }
+func (s stringSelector) optional() bool        { return false }
+func (s stringSelector) kind() adt.FeatureType { return adt.StringLabel }
 
 func (s stringSelector) feature(r adt.Runtime) adt.Feature {
 	return adt.MakeStringLabel(r, string(s))
@@ -544,10 +413,8 @@ func (s indexSelector) String() string {
 	return strconv.Itoa(adt.Feature(s).Index())
 }
 
-func (s indexSelector) labelType() SelectorType      { return IndexLabel }
-func (s indexSelector) constraintType() SelectorType { return 0 }
-
-func (s indexSelector) optional() bool { return false }
+func (s indexSelector) kind() adt.FeatureType { return adt.IntLabel }
+func (s indexSelector) optional() bool        { return false }
 
 func (s indexSelector) feature(r adt.Runtime) adt.Feature {
 	return adt.Feature(s)
@@ -556,16 +423,9 @@ func (s indexSelector) feature(r adt.Runtime) adt.Feature {
 // an anySelector represents a wildcard option of a particular type.
 type anySelector adt.Feature
 
-func (s anySelector) String() string { return "[_]" }
-func (s anySelector) optional() bool { return true }
-func (s anySelector) labelType() SelectorType {
-	// FeatureTypes are numbered sequentially. SelectorType is a bitmap. As they
-	// are defined in the same order, we can go from FeatureType to SelectorType
-	// by left shifting. As valid FeatureTypes starts at 1, we need to end with
-	// a final right shift.
-	return SelectorType((1 << adt.Feature(s).Typ()) >> 1)
-}
-func (s anySelector) constraintType() SelectorType { return PatternConstraint }
+func (s anySelector) String() string        { return "[_]" }
+func (s anySelector) optional() bool        { return true }
+func (s anySelector) kind() adt.FeatureType { return adt.Feature(s).Typ() }
 
 func (s anySelector) feature(r adt.Runtime) adt.Feature {
 	return adt.Feature(s)
@@ -575,22 +435,13 @@ func (s anySelector) feature(r adt.Runtime) adt.Feature {
 //
 // // ImportPath defines a lookup at the root of an instance. It must be the first
 // // element of a Path.
-//
-//	func ImportPath(s string) Selector {
-//		return importSelector(s)
-//	}
+// func ImportPath(s string) Selector {
+// 	return importSelector(s)
+// }
 type optionalSelector struct {
 	selector
 }
 
-func (s optionalSelector) labelType() SelectorType {
-	return s.selector.labelType()
-}
-
-func (s optionalSelector) constraintType() SelectorType {
-	return OptionalConstraint
-}
-
 func wrapOptional(sel Selector) Selector {
 	if !sel.sel.optional() {
 		sel = Selector{optionalSelector{sel.sel}}
@@ -628,10 +479,9 @@ type pathError struct {
 	errors.Error
 }
 
-func (p pathError) String() string               { return "" }
-func (p pathError) optional() bool               { return false }
-func (p pathError) labelType() SelectorType      { return InvalidSelectorType }
-func (p pathError) constraintType() SelectorType { return 0 }
+func (p pathError) String() string        { return "" }
+func (p pathError) optional() bool        { return false }
+func (p pathError) kind() adt.FeatureType { return 0 }
 func (p pathError) feature(r adt.Runtime) adt.Feature {
 	return adt.InvalidLabel
 }
diff --git a/vendor/cuelang.org/go/cue/scanner/scanner.go b/vendor/cuelang.org/go/cue/scanner/scanner.go
index 3e7fb3509..84b3643d3 100644
--- a/vendor/cuelang.org/go/cue/scanner/scanner.go
+++ b/vendor/cuelang.org/go/cue/scanner/scanner.go
@@ -567,14 +567,14 @@ func (s *Scanner) consumeStringClose(ch rune, quote quoteInfo) (next rune, atEnd
 	return s.ch, true
 }
 
-func (s *Scanner) scanHashes(maxHash int) int {
-	for i := 0; i < maxHash; i++ {
+func (s *Scanner) checkHashCount(offs int, quote quoteInfo) {
+	for i := 0; i < quote.numHash; i++ {
 		if s.ch != '#' {
-			return i
+			s.errf(offs, "string literal not terminated")
+			return
 		}
 		s.next()
 	}
-	return maxHash
 }
 
 func stripCR(b []byte) []byte {
@@ -830,18 +830,8 @@ scanAgain:
 				quote.numChar = 1
 				tok, lit = s.scanString(offs, quote)
 			case 1:
-				// When the string is surrounded by hashes,
-				// a single leading quote is OK (and part of the string)
-				// e.g. #""hello""#
-				// unless it's succeeded by the correct number of terminating
-				// hash characters
-				// e.g. ##""##
-				if n := s.scanHashes(quote.numHash); n == quote.numHash {
-					// It's the empty string.
-					tok, lit = token.STRING, string(s.src[offs:s.offset])
-				} else {
-					tok, lit = s.scanString(offs, quote)
-				}
+				s.checkHashCount(offs, quote)
+				tok, lit = token.STRING, string(s.src[offs:s.offset])
 			case 2:
 				quote.numChar = 3
 				switch s.ch {
diff --git a/vendor/cuelang.org/go/cue/stats/stats.go b/vendor/cuelang.org/go/cue/stats/stats.go
deleted file mode 100644
index 57a6ceddc..000000000
--- a/vendor/cuelang.org/go/cue/stats/stats.go
+++ /dev/null
@@ -1,118 +0,0 @@
-// Copyright 2022 CUE Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Package stats is an experimental package for getting statistics on CUE
-// evaluations.
-package stats
-
-import (
-	"html/template"
-	"strings"
-)
-
-// Counts holds counters for key events during a CUE evaluation.
-//
-// This is an experimental type and the contents may change without notice.
-type Counts struct {
-	// Operation counters
-	//
-	// These counters account for several key operations.
-
-	// Unifications counts the number of calls to adt.Unify
-	Unifications int
-
-	// Disjuncts indicates the number of total disjuncts processed as part
-	// of a Unify operation. A unification with no | operator counts as a
-	// single disjunct, so Disjuncts is always greater than or equal to the
-	// number of Unifications.
-	//
-	// If Disjuncts is much larger than Unification, this may indicate room
-	// for optimization. In particular, most practical uses of disjunctions
-	// should allow for near-linear processing.
-	Disjuncts int
-
-	// Conjuncts is an estimate of the number of conjunctions processed during
-	// the calls to Unify. This includes the conjuncts added in the compilation
-	// phase as well as the derivative conjuncts inserted from other nodes
-	// after following references.
-	//
-	// A number of Conjuncts much larger than Disjuncts may indicate non-linear
-	// algorithmic behavior.
-	Conjuncts int
-
-	// Buffer counters
-	//
-	// Each unification and disjunct operation is associated with an object
-	// with temporary buffers. Reuse of this buffer is critical for performance.
-	// The following counters track this.
-
-	Freed    int // Number of buffers returned to the free pool.
-	Reused   int // Number of times a buffer is reused instead of allocated.
-	Allocs   int // Total number of allocated buffer objects.
-	Retained int // Number of times a buffer is retained upon finalization.
-}
-
-func (c *Counts) Add(other Counts) {
-	c.Unifications += other.Unifications
-	c.Conjuncts += other.Conjuncts
-	c.Disjuncts += other.Disjuncts
-
-	c.Freed += other.Freed
-	c.Retained += other.Retained
-	c.Reused += other.Reused
-	c.Allocs += other.Allocs
-}
-
-func (c Counts) Since(start Counts) Counts {
-	c.Unifications -= start.Unifications
-	c.Conjuncts -= start.Conjuncts
-	c.Disjuncts -= start.Disjuncts
-
-	c.Freed -= start.Freed
-	c.Retained -= start.Retained
-	c.Reused -= start.Reused
-	c.Allocs -= start.Allocs
-
-	return c
-}
-
-// Leaks reports the number of nodeContext structs leaked. These are typically
-// benign, as they will just be garbage collected, as long as the pointer from
-// the original nodes has been eliminated or the original nodes are also not
-// referred to. But Leaks may have notable impact on performance, and thus
-// should be avoided.
-func (s Counts) Leaks() int {
-	return s.Allocs + s.Reused - s.Freed
-}
-
-var stats = template.Must(template.New("stats").Parse(`{{"" -}}
-
-Leaks:  {{.Leaks}}
-Freed:  {{.Freed}}
-Reused: {{.Reused}}
-Allocs: {{.Allocs}}
-Retain: {{.Retained}}
-
-Unifications: {{.Unifications}}
-Conjuncts:    {{.Conjuncts}}
-Disjuncts:    {{.Disjuncts}}`))
-
-func (s Counts) String() string {
-	buf := &strings.Builder{}
-	err := stats.Execute(buf, s)
-	if err != nil {
-		panic(err)
-	}
-	return buf.String()
-}
diff --git a/vendor/cuelang.org/go/cue/token/position.go b/vendor/cuelang.org/go/cue/token/position.go
index 577254f82..937108382 100644
--- a/vendor/cuelang.org/go/cue/token/position.go
+++ b/vendor/cuelang.org/go/cue/token/position.go
@@ -43,6 +43,7 @@ func (pos *Position) IsValid() bool { return pos.Line > 0 }
 //	line:column         valid position without file name
 //	file                invalid position with file name
 //	-                   invalid position without file name
+//
 func (pos Position) String() string {
 	s := pos.Filename
 	if pos.IsValid() {
@@ -60,6 +61,7 @@ func (pos Position) String() string {
 // Pos is a compact encoding of a source position within a file, as well as
 // relative positioning information. It can be converted into a Position for a
 // more convenient, but much larger, representation.
+//
 type Pos struct {
 	file   *File
 	offset int
@@ -67,6 +69,7 @@ type Pos struct {
 
 // File returns the file that contains the position p or nil if there is no
 // such file (for instance for p == NoPos).
+//
 func (p Pos) File() *File {
 	if p.index() == 0 {
 		return nil
@@ -247,6 +250,7 @@ func (f *File) LineCount() int {
 // AddLine adds the line offset for a new line.
 // The line offset must be larger than the offset for the previous line
 // and smaller than the file size; otherwise the line offset is ignored.
+//
 func (f *File) AddLine(offset int) {
 	x := index(offset)
 	f.mutex.Lock()
@@ -260,6 +264,7 @@ func (f *File) AddLine(offset int) {
 // the newline character at the end of the line with a space (to not change the
 // remaining offsets). To obtain the line number, consult e.g. Position.Line.
 // MergeLine will panic if given an invalid line number.
+//
 func (f *File) MergeLine(line int) {
 	if line <= 0 {
 		panic("illegal line number (line numbering starts at 1)")
@@ -286,6 +291,7 @@ func (f *File) MergeLine(line int) {
 // and smaller than the file size; otherwise SetLines fails and returns
 // false.
 // Callers must not mutate the provided slice after SetLines returns.
+//
 func (f *File) SetLines(lines []int) bool {
 	// verify validity of lines table
 	size := f.size
@@ -343,6 +349,7 @@ type lineInfo struct {
 //
 // AddLineInfo is typically used to register alternative position
 // information for //line filename:line comments in source files.
+//
 func (f *File) AddLineInfo(offset int, filename string, line int) {
 	x := index(offset)
 	f.mutex.Lock()
@@ -355,6 +362,7 @@ func (f *File) AddLineInfo(offset int, filename string, line int) {
 // Pos returns the Pos value for the given file offset;
 // the offset must be <= f.Size().
 // f.Pos(f.Offset(p)) == p.
+//
 func (f *File) Pos(offset int, rel RelPos) Pos {
 	if index(offset) > f.size {
 		panic("illegal file offset")
@@ -365,6 +373,7 @@ func (f *File) Pos(offset int, rel RelPos) Pos {
 // Offset returns the offset for the given file position p;
 // p must be a valid Pos value in that file.
 // f.Offset(f.Pos(offset)) == offset.
+//
 func (f *File) Offset(p Pos) int {
 	x := p.index()
 	if x < f.base || x > f.base+index(f.size) {
@@ -375,6 +384,7 @@ func (f *File) Offset(p Pos) int {
 
 // Line returns the line number for the given file position p;
 // p must be a Pos value in that file or NoPos.
+//
 func (f *File) Line(p Pos) int {
 	return f.Position(p).Line
 }
@@ -386,6 +396,7 @@ func searchLineInfos(a []lineInfo, x int) int {
 // unpack returns the filename and line and column number for a file offset.
 // If adjusted is set, unpack will return the filename and line information
 // possibly adjusted by //line comments; otherwise those comments are ignored.
+//
 func (f *File) unpack(offset index, adjusted bool) (filename string, line, column int) {
 	filename = f.name
 	if i := searchInts(f.lines, offset); i >= 0 {
@@ -415,6 +426,7 @@ func (f *File) position(p Pos, adjusted bool) (pos Position) {
 // If adjusted is set, the position may be adjusted by position-altering
 // //line comments; otherwise those comments are ignored.
 // p must be a Pos value in f or NoPos.
+//
 func (f *File) PositionFor(p Pos, adjusted bool) (pos Position) {
 	x := p.index()
 	if p != NoPos {
@@ -428,6 +440,7 @@ func (f *File) PositionFor(p Pos, adjusted bool) (pos Position) {
 
 // Position returns the Position value for the given file position p.
 // Calling f.Position(p) is equivalent to calling f.PositionFor(p, true).
+//
 func (f *File) Position(p Pos) (pos Position) {
 	return f.PositionFor(p, true)
 }
diff --git a/vendor/cuelang.org/go/cue/token/token.go b/vendor/cuelang.org/go/cue/token/token.go
index 657833969..5e1544344 100644
--- a/vendor/cuelang.org/go/cue/token/token.go
+++ b/vendor/cuelang.org/go/cue/token/token.go
@@ -212,6 +212,7 @@ const (
 // Precedence returns the operator precedence of the binary
 // operator op. If op is not a binary operator, the result
 // is LowestPrecedence.
+//
 func (tok Token) Precedence() int {
 	switch tok {
 	case OR:
@@ -242,6 +243,7 @@ func init() {
 }
 
 // Lookup maps an identifier to its keyword token or IDENT (if not a keyword).
+//
 func Lookup(ident string) Token {
 	if tok, isKeyword := keywords[ident]; isKeyword {
 		return tok
diff --git a/vendor/cuelang.org/go/cue/types.go b/vendor/cuelang.org/go/cue/types.go
index b4f6c44f2..11528bef1 100644
--- a/vendor/cuelang.org/go/cue/types.go
+++ b/vendor/cuelang.org/go/cue/types.go
@@ -26,7 +26,7 @@ import (
 	"github.com/cockroachdb/apd/v2"
 
 	"cuelang.org/go/cue/ast"
-	"cuelang.org/go/cue/build"
+	"cuelang.org/go/cue/ast/astutil"
 	"cuelang.org/go/cue/errors"
 	"cuelang.org/go/cue/token"
 	"cuelang.org/go/internal"
@@ -220,6 +220,7 @@ func unwrapJSONError(err error) errors.Error {
 }
 
 // An Iterator iterates over values.
+//
 type Iterator struct {
 	val   Value
 	idx   *runtime.Runtime
@@ -269,6 +270,7 @@ func (i *Iterator) Selector() Selector {
 // Label reports the label of the value if i iterates over struct fields and ""
 // otherwise.
 //
+//
 // Slated to be deprecated: use i.Selector().String(). Note that this will give
 // more accurate string representations.
 func (i *hiddenIterator) Label() string {
@@ -655,7 +657,7 @@ func Dereference(v Value) Value {
 	}
 
 	ctx := v.ctx()
-	n, b := ctx.Resolve(c, r)
+	n, b := ctx.Resolve(c.Env, r)
 	if b != nil {
 		return newErrValue(v, b)
 	}
@@ -983,7 +985,6 @@ func (v Value) Syntax(opts ...Option) ast.Node {
 		ShowAttributes:  !o.omitAttrs,
 		ShowDocs:        o.docs,
 		ShowErrors:      o.showErrors,
-		InlineImports:   o.inlineImports,
 	}
 
 	pkgID := v.instance().ID()
@@ -1015,12 +1016,20 @@ You could file a bug with the above information at:
 	var err error
 	var f *ast.File
 	if o.concrete || o.final || o.resolveReferences {
-		f, err = p.Vertex(v.idx, pkgID, v.v)
+		// inst = v.instance()
+		var expr ast.Expr
+		expr, err = p.Value(v.idx, pkgID, v.v)
+		if err != nil {
+			return bad(`"cuelang.org/go/internal/core/export".Value`, err)
+		}
+
+		// This introduces gratuitous unshadowing!
+		f, err = astutil.ToFile(expr)
 		if err != nil {
-			return bad(`"cuelang.org/go/internal/core/export".Vertex`, err)
+			return bad(`"cuelang.org/go/ast/astutil".ToFile`, err)
 		}
+		// return expr
 	} else {
-		p.AddPackage = true
 		f, err = p.Def(v.idx, pkgID, v.v)
 		if err != nil {
 			return bad(`"cuelang.org/go/internal/core/export".Def`, err)
@@ -1076,9 +1085,9 @@ func (v hiddenValue) Split() []Value {
 }
 
 // Source returns the original node for this value. The return value may not
-// be an [ast.Expr]. For instance, a struct kind may be represented by a
+// be a syntax.Expr. For instance, a struct kind may be represented by a
 // struct literal, a field comprehension, or a file. It returns nil for
-// computed nodes. Use [Value.Expr] to get all source values that apply to a field.
+// computed nodes. Use Split to get all source values that apply to a field.
 func (v Value) Source() ast.Node {
 	if v.v == nil {
 		return nil
@@ -1089,18 +1098,6 @@ func (v Value) Source() ast.Node {
 	return v.v.Value().Source()
 }
 
-// If v exactly represents a package, BuildInstance returns
-// the build instance corresponding to the value; otherwise it returns nil.
-//
-// The value returned by Value.ReferencePath will commonly represent
-// a package.
-func (v Value) BuildInstance() *build.Instance {
-	if v.idx == nil {
-		return nil
-	}
-	return v.idx.GetInstanceFromNode(v.v)
-}
-
 // Err returns the error represented by v or nil v is not an error.
 func (v Value) Err() error {
 	if err := v.checkKind(v.ctx(), adt.BottomKind); err != nil {
@@ -1402,9 +1399,6 @@ func (v Value) structValOpts(ctx *adt.OpContext, o options) (s structValue, err
 
 	k := 0
 	for _, f := range features {
-		if f.IsLet() {
-			continue
-		}
 		if f.IsDef() && (o.omitDefinitions || o.concrete) {
 			continue
 		}
@@ -1434,9 +1428,8 @@ func (v Value) structValOpts(ctx *adt.OpContext, o options) (s structValue, err
 
 // Struct returns the underlying struct of a value or an error if the value
 // is not a struct.
-//
-// Deprecated: use Fields.
 func (v hiddenValue) Struct() (*Struct, error) {
+	// TODO: deprecate
 	ctx := v.ctx()
 	obj, err := v.structValOpts(ctx, options{})
 	if err != nil {
@@ -1580,7 +1573,7 @@ func appendPath(a []Selector, v Value) []Selector {
 	}
 
 	var sel selector
-	switch t := f.Typ(); t {
+	switch f.Typ() {
 	case adt.IntLabel:
 		sel = indexSelector(f)
 	case adt.DefinitionLabel:
@@ -1594,9 +1587,6 @@ func appendPath(a []Selector, v Value) []Selector {
 
 	case adt.StringLabel:
 		sel = stringSelector(f.StringValue(v.idx))
-
-	default:
-		panic(fmt.Sprintf("unsupported label type %v", t))
 	}
 	return append(a, Selector{sel})
 }
@@ -1690,6 +1680,7 @@ func (v hiddenValue) Fill(x interface{}, path ...string) Value {
 //
 // Any reference in v referring to the value at the given path will resolve to x
 // in the newly created value. The resulting value is not validated.
+//
 func (v Value) FillPath(p Path, x interface{}) Value {
 	if v.v == nil {
 		// TODO: panic here?
@@ -1714,8 +1705,8 @@ func (v Value) FillPath(p Path, x interface{}) Value {
 		expr = convert.GoValueToValue(ctx, x, true)
 	}
 	for i := len(p.path) - 1; i >= 0; i-- {
-		switch sel := p.path[i]; sel.Type() {
-		case StringLabel | PatternConstraint:
+		switch sel := p.path[i].sel; {
+		case sel == AnyString.sel:
 			expr = &adt.StructLit{Decls: []adt.Decl{
 				&adt.BulkOptionalField{
 					Filter: &adt.BasicType{K: adt.StringKind},
@@ -1723,13 +1714,17 @@ func (v Value) FillPath(p Path, x interface{}) Value {
 				},
 			}}
 
-		case IndexLabel | PatternConstraint:
+		case sel == anyIndex.sel:
 			expr = &adt.ListLit{Elems: []adt.Elem{
 				&adt.Ellipsis{Value: expr},
 			}}
 
-		case IndexLabel:
-			i := sel.Index()
+		case sel == anyDefinition.sel:
+			expr = &adt.Bottom{Err: errors.Newf(token.NoPos,
+				"AnyDefinition not supported")}
+
+		case sel.kind() == adt.IntLabel:
+			i := sel.feature(ctx.Runtime).Index()
 			list := &adt.ListLit{}
 			any := &adt.Top{}
 			// TODO(perf): make this a constant thing. This will be possible with the query extension.
@@ -1741,14 +1736,14 @@ func (v Value) FillPath(p Path, x interface{}) Value {
 
 		default:
 			var d adt.Decl
-			if sel.ConstraintType() == OptionalConstraint {
+			if sel.optional() {
 				d = &adt.OptionalField{
-					Label: sel.sel.feature(v.idx),
+					Label: sel.feature(v.idx),
 					Value: expr,
 				}
 			} else {
 				d = &adt.Field{
-					Label: sel.sel.feature(v.idx),
+					Label: sel.feature(v.idx),
 					Value: expr,
 				}
 			}
@@ -2052,7 +2047,6 @@ type options struct {
 	omitDefinitions   bool
 	omitOptional      bool
 	omitAttrs         bool
-	inlineImports     bool
 	resolveReferences bool
 	showErrors        bool
 	final             bool
@@ -2102,24 +2096,14 @@ func Concrete(concrete bool) Option {
 	}
 }
 
-// InlineImports causes references to values within imported packages to be
-// inlined. References to builtin packages are not inlined.
-func InlineImports(expand bool) Option {
-	return func(p *options) { p.inlineImports = expand }
-}
-
-// DisallowCycles forces validation in the presence of cycles, even if
+// DisallowCycles forces validation in the precense of cycles, even if
 // non-concrete values are allowed. This is implied by Concrete(true).
 func DisallowCycles(disallow bool) Option {
 	return func(p *options) { p.disallowCycles = disallow }
 }
 
 // ResolveReferences forces the evaluation of references when outputting.
-//
-// Deprecated: Syntax will now always attempt to resolve dangling references and
-// make the output self-contained. When Final or Concrete is used, it will
-// already attempt to resolve all references.
-// See also InlineImports.
+// This implies the input cannot have cycles.
 func ResolveReferences(resolve bool) Option {
 	return func(p *options) {
 		p.resolveReferences = resolve
@@ -2137,14 +2121,6 @@ func ResolveReferences(resolve bool) Option {
 	}
 }
 
-// ErrorsAsValues treats errors as a regular value, including them at the
-// location in the tree where they occur, instead of interpreting them as a
-// configuration-wide failure that is returned instead of root value.
-// Used by Syntax.
-func ErrorsAsValues(show bool) Option {
-	return func(p *options) { p.showErrors = show }
-}
-
 // Raw tells Syntax to generate the value as is without any simplifications.
 func Raw() Option {
 	return func(p *options) { p.raw = true }
@@ -2210,9 +2186,6 @@ func (o *options) updateOptions(opts []Option) {
 // Validate reports any errors, recursively. The returned error may represent
 // more than one error, retrievable with errors.Errors, if more than one
 // exists.
-//
-// Note that by default not all errors are reported, unless options like
-// Concrete are used.
 func (v Value) Validate(opts ...Option) error {
 	o := options{}
 	o.updateOptions(opts)
@@ -2225,7 +2198,7 @@ func (v Value) Validate(opts ...Option) error {
 
 	b := validate.Validate(v.ctx(), v.v, cfg)
 	if b != nil {
-		return v.toErr(b)
+		return b.Err
 	}
 	return nil
 }
diff --git a/vendor/cuelang.org/go/internal/core/adt/adt.go b/vendor/cuelang.org/go/internal/core/adt/adt.go
index 1554f2311..1a286e759 100644
--- a/vendor/cuelang.org/go/internal/core/adt/adt.go
+++ b/vendor/cuelang.org/go/internal/core/adt/adt.go
@@ -33,13 +33,13 @@ func Resolve(ctx *OpContext, c Conjunct) *Vertex {
 
 	var v Value
 
-	expr := c.Elem() // TODO: why is this not Expr?
+	expr := c.Elem()
 	switch x := expr.(type) {
 	case Value:
 		v = x
 
 	case Resolver:
-		r, err := ctx.resolveState(c, x, Finalized)
+		r, err := ctx.Resolve(env, x)
 		if err != nil {
 			v = err
 			break
@@ -108,7 +108,7 @@ type Evaluator interface {
 
 	// evaluate evaluates the underlying expression. If the expression
 	// is incomplete, it may record the error in ctx and return nil.
-	evaluate(ctx *OpContext, state VertexStatus) Value
+	evaluate(ctx *OpContext) Value
 }
 
 // A Resolver represents a reference somewhere else within a tree that resolves
@@ -123,7 +123,7 @@ type YieldFunc func(env *Environment)
 // A Yielder represents 0 or more labeled values of structs or lists.
 type Yielder interface {
 	Node
-	yield(s *compState)
+	yield(ctx *OpContext, fn YieldFunc)
 }
 
 // A Validator validates a Value. All Validators are Values.
@@ -236,8 +236,6 @@ func (*Field) declNode()                {}
 func (x *Field) expr() Expr             { return x.Value }
 func (*OptionalField) declNode()        {}
 func (x *OptionalField) expr() Expr     { return x.Value }
-func (*LetField) declNode()             {}
-func (x *LetField) expr() Expr          { return x.Value }
 func (*BulkOptionalField) declNode()    {}
 func (x *BulkOptionalField) expr() Expr { return x.Value }
 func (*DynamicField) declNode()         {}
@@ -372,7 +370,6 @@ func (*CallExpr) node()          {}
 func (*DisjunctionExpr) node()   {}
 func (*Field) node()             {}
 func (*OptionalField) node()     {}
-func (*LetField) node()          {}
 func (*BulkOptionalField) node() {}
 func (*DynamicField) node()      {}
 func (*Ellipsis) node()          {}
@@ -380,3 +377,4 @@ func (*Comprehension) node()     {}
 func (*ForClause) node()         {}
 func (*IfClause) node()          {}
 func (*LetClause) node()         {}
+func (*ValueClause) node()       {}
diff --git a/vendor/cuelang.org/go/internal/core/adt/binop.go b/vendor/cuelang.org/go/internal/core/adt/binop.go
index 556e189c8..e2410a1e8 100644
--- a/vendor/cuelang.org/go/internal/core/adt/binop.go
+++ b/vendor/cuelang.org/go/internal/core/adt/binop.go
@@ -182,17 +182,15 @@ func BinOp(c *OpContext, op Op, left, right Value) Value {
 
 			x := MakeIdentLabel(c, "x", "")
 
-			// for x in expr { x }
 			forClause := func(src Expr) *Comprehension {
 				s := &StructLit{Decls: []Decl{
 					&FieldReference{UpCount: 1, Label: x},
 				}}
 				return &Comprehension{
-					Clauses: []Yielder{
-						&ForClause{
-							Value: x,
-							Src:   src,
-						},
+					Clauses: &ForClause{
+						Value: x,
+						Src:   src,
+						Dst:   &ValueClause{s},
 					},
 					Value: s,
 				}
@@ -206,8 +204,8 @@ func BinOp(c *OpContext, op Op, left, right Value) Value {
 			}
 
 			n := &Vertex{}
-			n.AddConjunct(MakeConjunct(c.Env(0), list, c.ci))
-			c.Unify(n, Conjuncts)
+			n.AddConjunct(MakeRootConjunct(c.Env(0), list))
+			n.Finalize(c)
 
 			return n
 		}
@@ -253,11 +251,10 @@ func BinOp(c *OpContext, op Op, left, right Value) Value {
 				}}
 				list.Elems = append(list.Elems,
 					&Comprehension{
-						Clauses: []Yielder{
-							&ForClause{
-								Value: x,
-								Src:   right,
-							},
+						Clauses: &ForClause{
+							Value: x,
+							Src:   right,
+							Dst:   &ValueClause{st},
 						},
 						Value: st,
 					},
@@ -268,8 +265,8 @@ func BinOp(c *OpContext, op Op, left, right Value) Value {
 			}
 
 			n := &Vertex{}
-			n.AddConjunct(MakeConjunct(c.Env(0), list, c.ci))
-			c.Unify(n, Conjuncts)
+			n.AddConjunct(MakeRootConjunct(c.Env(0), list))
+			n.Finalize(c)
 
 			return n
 		}
diff --git a/vendor/cuelang.org/go/internal/core/adt/closed.go b/vendor/cuelang.org/go/internal/core/adt/closed.go
index 5281a32ef..34a3e45e3 100644
--- a/vendor/cuelang.org/go/internal/core/adt/closed.go
+++ b/vendor/cuelang.org/go/internal/core/adt/closed.go
@@ -70,11 +70,9 @@ package adt
 // TODO(errors): return a dedicated ConflictError that can track original
 // positions on demand.
 
-// IsInOneOf reports whether any of the Structs associated with v is contained
-// within any of the span types in the given mask.
-func (v *Vertex) IsInOneOf(mask SpanType) bool {
+func (v *Vertex) IsInOneOf(t SpanType) bool {
 	for _, s := range v.Structs {
-		if s.CloseInfo.IsInOneOf(mask) {
+		if s.CloseInfo.IsInOneOf(t) {
 			return true
 		}
 	}
@@ -110,15 +108,8 @@ const (
 type CloseInfo struct {
 	*closeInfo
 
-	// IsClosed is true if this conjunct represents a single level of closing
-	// as indicated by the closed builtin.
-	IsClosed bool
-
-	// FieldTypes indicates which kinds of fields (optional, dynamic, patterns,
-	// etc.) are contained in this conjunct.
+	IsClosed   bool
 	FieldTypes OptionalType
-
-	CycleInfo
 }
 
 func (c CloseInfo) Location() Node {
@@ -128,11 +119,11 @@ func (c CloseInfo) Location() Node {
 	return c.closeInfo.location
 }
 
-func (c CloseInfo) span() SpanType {
+func (c CloseInfo) SpanMask() SpanType {
 	if c.closeInfo == nil {
 		return 0
 	}
-	return c.closeInfo.span
+	return c.span
 }
 
 func (c CloseInfo) RootSpanType() SpanType {
@@ -142,10 +133,11 @@ func (c CloseInfo) RootSpanType() SpanType {
 	return c.root
 }
 
-// IsInOneOf reports whether c is contained within any of the span types in the
-// given mask.
 func (c CloseInfo) IsInOneOf(t SpanType) bool {
-	return c.span()&t != 0
+	if c.closeInfo == nil {
+		return false
+	}
+	return c.span&t != 0
 }
 
 // TODO(perf): remove: error positions should always be computed on demand
@@ -160,13 +152,18 @@ func (c *CloseInfo) AddPositions(ctx *OpContext) {
 
 // TODO(perf): use on StructInfo. Then if parent and expression are the same
 // it is possible to use cached value.
-func (c CloseInfo) SpawnEmbed(x Node) CloseInfo {
+func (c CloseInfo) SpawnEmbed(x Expr) CloseInfo {
+	var span SpanType
+	if c.closeInfo != nil {
+		span = c.span
+	}
+
 	c.closeInfo = &closeInfo{
 		parent:   c.closeInfo,
 		location: x,
 		mode:     closeEmbed,
 		root:     EmbeddingSpan,
-		span:     c.span() | EmbeddingSpan,
+		span:     span | EmbeddingSpan,
 	}
 	return c
 }
@@ -174,12 +171,17 @@ func (c CloseInfo) SpawnEmbed(x Node) CloseInfo {
 // SpawnGroup is used for structs that contain embeddings that may end up
 // closing the struct. This is to force that `b` is not allowed in
 //
-//	a: {#foo} & {b: int}
+//      a: {#foo} & {b: int}
+//
 func (c CloseInfo) SpawnGroup(x Expr) CloseInfo {
+	var span SpanType
+	if c.closeInfo != nil {
+		span = c.span
+	}
 	c.closeInfo = &closeInfo{
 		parent:   c.closeInfo,
 		location: x,
-		span:     c.span(),
+		span:     span,
 	}
 	return c
 }
@@ -188,34 +190,28 @@ func (c CloseInfo) SpawnGroup(x Expr) CloseInfo {
 // or constraint. Definition and embedding spans are introduced with SpawnRef
 // and SpawnEmbed, respectively.
 func (c CloseInfo) SpawnSpan(x Node, t SpanType) CloseInfo {
+	var span SpanType
+	if c.closeInfo != nil {
+		span = c.span
+	}
 	c.closeInfo = &closeInfo{
 		parent:   c.closeInfo,
 		location: x,
 		root:     t,
-		span:     c.span() | t,
+		span:     span | t,
 	}
 	return c
 }
 
 func (c CloseInfo) SpawnRef(arc *Vertex, isDef bool, x Expr) CloseInfo {
-	span := c.span()
-	found := false
-	if !isDef {
-		xnode := Node(x) // Optimization so we're comparing identical interface types.
-		// TODO: make this work for non-definitions too.
-		for p := c.closeInfo; p != nil; p = p.parent {
-			if p.span == span && p.location == xnode {
-				found = true
-				break
-			}
-		}
+	var span SpanType
+	if c.closeInfo != nil {
+		span = c.span
 	}
-	if !found {
-		c.closeInfo = &closeInfo{
-			parent:   c.closeInfo,
-			location: x,
-			span:     span,
-		}
+	c.closeInfo = &closeInfo{
+		parent:   c.closeInfo,
+		location: x,
+		span:     span,
 	}
 	if isDef {
 		c.mode = closeDef
@@ -303,27 +299,23 @@ type closeStats struct {
 	accepted bool
 
 	required bool
-
-	inTodoList bool // true if added to todo list.
-	next       *closeStats
+	next     *closeStats
 }
 
 func (c *closeInfo) isClosed() bool {
 	return c.mode == closeDef
 }
 
-// isClosed reports whether v is closed at this level (so not recursively).
 func isClosed(v *Vertex) bool {
-	// We could have used IsRecursivelyClosed here, but (effectively)
-	// implementing it again here allows us to only have to iterate over
-	// Structs once.
-	if v.Closed {
-		return true
-	}
 	for _, s := range v.Structs {
-		if s.IsClosed || s.IsInOneOf(DefinitionSpan) {
+		if s.IsClosed {
 			return true
 		}
+		for c := s.closeInfo; c != nil; c = c.parent {
+			if c.isClosed() {
+				return true
+			}
+		}
 	}
 	return false
 }
@@ -406,10 +398,9 @@ func markRequired(ctx *OpContext, info *closeInfo) {
 			return
 		}
 
-		if s.span&EmbeddingSpan == 0 && !x.inTodoList {
+		if s.span&EmbeddingSpan == 0 {
 			x.next = ctx.todo
 			ctx.todo = x
-			x.inTodoList = true
 		}
 
 		x.required = true
@@ -501,7 +492,6 @@ func verifyArc(ctx *OpContext, s *StructInfo, f Feature, label Value) bool {
 	if len(o.Dynamic) > 0 && f.IsString() && label != nil {
 		for _, b := range o.Dynamic {
 			v := env.evalCached(ctx, b.Key)
-			v, _ = ctx.getDefault(v)
 			s, ok := Unwrap(v).(*String)
 			if !ok {
 				continue
diff --git a/vendor/cuelang.org/go/internal/core/adt/closed2.go b/vendor/cuelang.org/go/internal/core/adt/closed2.go
index c2c1b6113..ada0342d2 100644
--- a/vendor/cuelang.org/go/internal/core/adt/closed2.go
+++ b/vendor/cuelang.org/go/internal/core/adt/closed2.go
@@ -63,5 +63,6 @@ func verifyArc2(ctx *OpContext, f Feature, v *Vertex, isClosed bool) (found bool
 		s.AddPositions(ctx)
 	}
 
-	return false, ctx.NewErrf("field not allowed")
+	label := f.SelectorString(ctx)
+	return false, ctx.NewErrf("field not allowed: %s", label)
 }
diff --git a/vendor/cuelang.org/go/internal/core/adt/composite.go b/vendor/cuelang.org/go/internal/core/adt/composite.go
index 5f13c393c..603abf238 100644
--- a/vendor/cuelang.org/go/internal/core/adt/composite.go
+++ b/vendor/cuelang.org/go/internal/core/adt/composite.go
@@ -91,46 +91,59 @@ type Environment struct {
 	// TODO(perf): make the following public fields a shareable struct as it
 	// mostly is going to be the same for child nodes.
 
-	// TODO: This can probably move into the nodeContext, making it a map from
-	// conjunct to Value.
-	cache map[cacheKey]Value
-}
+	// Cyclic indicates a structural cycle was detected for this conjunct or one
+	// of its ancestors.
+	Cyclic bool
 
-type cacheKey struct {
-	Expr Expr
-	Arc  *Vertex
-}
+	// Deref keeps track of nodes that should dereference to Vertex. It is used
+	// for detecting structural cycle.
+	//
+	// The detection algorithm is based on Tomabechi's quasi-destructive graph
+	// unification. This detection requires dependencies to be resolved into
+	// fully dereferenced vertices. This is not the case in our algorithm:
+	// the result of evaluating conjuncts is placed into dereferenced vertices
+	// _after_ they are evaluated, but the Environment still points to the
+	// non-dereferenced context.
+	//
+	// In order to be able to detect structural cycles, we need to ensure that
+	// at least one node that is part of a cycle in the context in which
+	// conjunctions are evaluated dereferences correctly.
+	//
+	// The only field necessary to detect a structural cycle, however, is
+	// the Status field of the Vertex. So rather than dereferencing a node
+	// proper, it is sufficient to copy the Status of the dereferenced nodes
+	// to these nodes (will always be EvaluatingArcs).
+	Deref []*Vertex
+
+	// Cycles contains vertices for which cycles are detected. It is used
+	// for tracking self-references within structural cycles.
+	//
+	// Unlike Deref, Cycles is not incremented with child nodes.
+	// TODO: Cycles is always a tail end of Deref, so this can be optimized.
+	Cycles []*Vertex
 
-func (e *Environment) up(count int32) *Environment {
-	for ; count > 0; count-- {
-		e = e.Up
-	}
-	return e
+	cache map[Expr]Value
 }
 
 type ID int32
 
-// evalCached is used to look up dynamic field pattern constraint expressions.
+// evalCached is used to look up let expressions. Caching let expressions
+// prevents a possible combinatorial explosion.
 func (e *Environment) evalCached(c *OpContext, x Expr) Value {
 	if v, ok := x.(Value); ok {
 		return v
 	}
-	key := cacheKey{x, nil}
-	v, ok := e.cache[key]
+	v, ok := e.cache[x]
 	if !ok {
 		if e.cache == nil {
-			e.cache = map[cacheKey]Value{}
+			e.cache = map[Expr]Value{}
 		}
 		env, src := c.e, c.src
 		c.e, c.src = e, x.Source()
-		// Save and restore errors to ensure that only relevant errors are
-		// associated with the cash.
-		err := c.errs
 		v = c.evalState(x, Partial) // TODO: should this be Finalized?
 		c.e, c.src = env, src
-		c.errs = err
 		if b, ok := v.(*Bottom); !ok || !b.IsIncomplete() {
-			e.cache[key] = v
+			e.cache[x] = v
 		}
 	}
 	return v
@@ -150,6 +163,9 @@ type Vertex struct {
 	// tree.
 	Parent *Vertex
 
+	// Label is the feature leading to this vertex.
+	Label Feature
+
 	// State:
 	//   eval: nil, BaseValue: nil -- unevaluated
 	//   eval: *,   BaseValue: nil -- evaluating
@@ -158,50 +174,24 @@ type Vertex struct {
 	state *nodeContext
 	// TODO: move the following status fields to nodeContext.
 
-	// Label is the feature leading to this vertex.
-	Label Feature
-
-	// TODO: move the following status fields to nodeContext.
-
 	// status indicates the evaluation progress of this vertex.
 	status VertexStatus
 
-	// hasAllConjuncts indicates that the set of conjuncts is complete.
-	// This is the case if the conjuncts of all its ancestors have been
-	// processed.
-	hasAllConjuncts bool
-
 	// isData indicates that this Vertex is to be interepreted as data: pattern
 	// and additional constraints, as well as optional fields, should be
 	// ignored.
-	isData bool
+	isData                bool
+	Closed                bool
+	nonMonotonicReject    bool
+	nonMonotonicInsertGen int32
+	nonMonotonicLookupGen int32
 
-	// Closed indicates whether this Vertex is recursively closed. This is the
-	// case, for instance, if it is a node in a definition or if one of the
-	// conjuncts, or ancestor conjuncts, is a definition.
-	Closed bool
+	// EvalCount keeps track of temporary dereferencing during evaluation.
+	// If EvalCount > 0, status should be considered to be EvaluatingArcs.
+	EvalCount int32
 
-	// MultiLet indicates whether multiple let fields were added from
-	// different sources. If true, a LetReference must be resolved using
-	// the per-Environment value cache.
-	MultiLet bool
-
-	// After this is set, no more arcs may be added during evaluation. This is
-	// set, for instance, after a Vertex is used as a source for comprehensions,
-	// or any other operation that relies on the set of arcs being constant.
-	LockArcs bool
-
-	// IsDynamic signifies whether this struct is computed as part of an
-	// expression and not part of the static evaluation tree.
-	// Used for cycle detection.
-	IsDynamic bool
-
-	// arcType indicates the level of optionality of this arc.
-	arcType arcType
-
-	// cyclicReferences is a linked list of internal references pointing to this
-	// Vertex. This is used to shorten the path of some structural cycles.
-	cyclicReferences *RefNode
+	// SelfCount is used for tracking self-references.
+	SelfCount int32
 
 	// BaseValue is the value associated with this vertex. For lists and structs
 	// this is a sentinel value indicating its kind.
@@ -227,42 +217,6 @@ type Vertex struct {
 	Structs []*StructInfo
 }
 
-// isDefined indicates whether this arc is a "value" field, and not a constraint
-// or void arc.
-func (v *Vertex) isDefined() bool {
-	return v.arcType == arcMember
-}
-
-// IsDefined indicates whether this arc is defined meaning it is not a
-// required or optional constraint and not a "void" arc.
-// It will evaluate the arc, and thus evaluate any comprehension, to make this
-// determination.
-func (v *Vertex) IsDefined(c *OpContext) bool {
-	if v.isDefined() {
-		return true
-	}
-	c.Unify(v, Finalized)
-	return v.isDefined()
-}
-
-type arcType uint8
-
-const (
-	// arcMember means that this arc is a normal non-optional field
-	// (including regular, hidden, and definition fields).
-	arcMember arcType = iota
-
-	// TODO: define a type for optional arcs. This will be needed for pulling
-	// in optional fields into the Vertex, which, in turn, is needed for
-	// structure sharing, among other things.
-	// We could also define types for required fields and potentially lets.
-
-	// arcVoid means that an arc does not exist. This happens when an arc
-	// is provisionally added as part of a comprehension, but when this
-	// comprehension has not yet yielded any results.
-	arcVoid
-)
-
 func (v *Vertex) Clone() *Vertex {
 	c := *v
 	c.state = nil
@@ -313,9 +267,9 @@ const (
 	// nodeContext to allow reusing the computations done so far.
 	Partial
 
-	// Conjuncts is the state reached when all conjuncts have been evaluated,
-	// but without recursively processing arcs.
-	Conjuncts
+	// AllArcs is request only. It must be past Partial, but
+	// before recursively resolving arcs.
+	AllArcs
 
 	// EvaluatingArcs indicates that the arcs of the Vertex are currently being
 	// evaluated. If this is encountered it indicates a structural cycle.
@@ -335,8 +289,8 @@ func (s VertexStatus) String() string {
 		return "evaluating"
 	case Partial:
 		return "partial"
-	case Conjuncts:
-		return "conjuncts"
+	case AllArcs:
+		return "allarcs"
 	case EvaluatingArcs:
 		return "evaluatingArcs"
 	case Finalized:
@@ -347,6 +301,9 @@ func (s VertexStatus) String() string {
 }
 
 func (v *Vertex) Status() VertexStatus {
+	if v.EvalCount > 0 {
+		return EvaluatingArcs
+	}
 	return v.status
 }
 
@@ -359,27 +316,6 @@ func (v *Vertex) UpdateStatus(s VertexStatus) {
 	v.status = s
 }
 
-// setParentDone signals v that the conjuncts of all ancestors have been
-// processed.
-// If all conjuncts of this node have been set, all arcs will be notified
-// of this parent being done.
-//
-// Note: once a vertex has started evaluation (state != nil), insertField will
-// cause all conjuncts to be immediately processed. This means that if all
-// ancestors of this node processed their conjuncts, and if this node has
-// processed all its conjuncts as well, all nodes that it embedded will have
-// received all their conjuncts as well, after which this node will have been
-// notified of these conjuncts.
-func (v *Vertex) setParentDone() {
-	v.hasAllConjuncts = true
-	// Could set "Conjuncts" flag of arc at this point.
-	if n := v.state; n != nil && len(n.conjuncts) == 0 {
-		for _, a := range v.Arcs {
-			a.setParentDone()
-		}
-	}
-}
-
 // Value returns the Value of v without definitions if it is a scalar
 // or itself otherwise.
 func (v *Vertex) Value() Value {
@@ -398,9 +334,6 @@ func (v *Vertex) Value() Value {
 
 // isUndefined reports whether a vertex does not have a useable BaseValue yet.
 func (v *Vertex) isUndefined() bool {
-	if !v.isDefined() {
-		return true
-	}
 	switch v.BaseValue {
 	case nil, cycle:
 		return true
@@ -432,21 +365,18 @@ func (v *Vertex) ToDataSingle() *Vertex {
 
 // ToDataAll returns a new v where v and all its descendents contain only
 // the regular fields.
-func (v *Vertex) ToDataAll(ctx *OpContext) *Vertex {
+func (v *Vertex) ToDataAll() *Vertex {
 	arcs := make([]*Vertex, 0, len(v.Arcs))
 	for _, a := range v.Arcs {
-		if !a.IsDefined(ctx) {
-			continue
-		}
 		if a.Label.IsRegular() {
-			arcs = append(arcs, a.ToDataAll(ctx))
+			arcs = append(arcs, a.ToDataAll())
 		}
 	}
 	w := *v
 	w.state = nil
 	w.status = Finalized
 
-	w.BaseValue = toDataAll(ctx, w.BaseValue)
+	w.BaseValue = toDataAll(w.BaseValue)
 	w.Arcs = arcs
 	w.isData = true
 	w.Conjuncts = make([]Conjunct, len(v.Conjuncts))
@@ -458,19 +388,19 @@ func (v *Vertex) ToDataAll(ctx *OpContext) *Vertex {
 	copy(w.Conjuncts, v.Conjuncts)
 	for i, c := range w.Conjuncts {
 		if v, _ := c.x.(Value); v != nil {
-			w.Conjuncts[i].x = toDataAll(ctx, v).(Value)
+			w.Conjuncts[i].x = toDataAll(v).(Value)
 		}
 	}
 	return &w
 }
 
-func toDataAll(ctx *OpContext, v BaseValue) BaseValue {
+func toDataAll(v BaseValue) BaseValue {
 	switch x := v.(type) {
 	default:
 		return x
 
 	case *Vertex:
-		return x.ToDataAll(ctx)
+		return x.ToDataAll()
 
 	// The following cases are always erroneous, but we handle them anyway
 	// to avoid issues with the closedness algorithm down the line.
@@ -478,7 +408,7 @@ func toDataAll(ctx *OpContext, v BaseValue) BaseValue {
 		d := *x
 		d.Values = make([]*Vertex, len(x.Values))
 		for i, v := range x.Values {
-			d.Values[i] = v.ToDataAll(ctx)
+			d.Values[i] = v.ToDataAll()
 		}
 		return &d
 
@@ -487,7 +417,7 @@ func toDataAll(ctx *OpContext, v BaseValue) BaseValue {
 		c.Values = make([]Value, len(x.Values))
 		for i, v := range x.Values {
 			// This case is okay because the source is of type Value.
-			c.Values[i] = toDataAll(ctx, v).(Value)
+			c.Values[i] = toDataAll(v).(Value)
 		}
 		return &c
 	}
@@ -550,8 +480,8 @@ func ToVertex(v Value) *Vertex {
 	}
 }
 
-// Unwrap returns the possibly non-concrete scalar value of v, v itself for
-// lists and structs, or nil if v is an undefined type.
+// Unwrap returns the possibly non-concrete scalar value of v or nil if v is
+// a list, struct or of undefined type.
 func Unwrap(v Value) Value {
 	x, ok := v.(*Vertex)
 	if !ok {
@@ -599,8 +529,6 @@ func (v *Vertex) Kind() Kind {
 	// This is possible when evaluating comprehensions. It is potentially
 	// not known at this time what the type is.
 	switch {
-	// TODO: using this line would be more stable.
-	// case v.status != Finalized && v.state != nil:
 	case v.state != nil:
 		return v.state.kind
 	case v.BaseValue == nil:
@@ -622,7 +550,7 @@ func (v *Vertex) OptionalTypes() OptionalType {
 // as opposed to whether it is allowed by a pattern constraint.
 func (v *Vertex) IsOptional(label Feature) bool {
 	for _, s := range v.Structs {
-		if s.IsOptionalField(label) {
+		if s.IsOptional(label) {
 			return true
 		}
 	}
@@ -645,7 +573,7 @@ func (v *Vertex) IsClosedStruct() bool {
 
 	case *Disjunction:
 	}
-	return isClosed(v)
+	return v.Closed || isClosed(v)
 }
 
 func (v *Vertex) IsClosedList() bool {
@@ -746,25 +674,33 @@ func (v *Vertex) Elems() []*Vertex {
 
 // GetArc returns a Vertex for the outgoing arc with label f. It creates and
 // ads one if it doesn't yet exist.
-func (v *Vertex) GetArc(c *OpContext, f Feature, t arcType) (arc *Vertex, isNew bool) {
+func (v *Vertex) GetArc(c *OpContext, f Feature) (arc *Vertex, isNew bool) {
 	arc = v.Lookup(f)
-	if arc != nil {
-		return arc, false
-	}
-
-	if v.LockArcs {
-		// TODO(errors): add positions.
-		if f.IsInt() {
-			c.addErrf(EvalError, token.NoPos,
-				"element at index %s not allowed by earlier comprehension or reference cycle", f)
-		} else {
-			c.addErrf(EvalError, token.NoPos,
-				"field %s not allowed by earlier comprehension or reference cycle", f)
+	if arc == nil {
+		for _, a := range v.state.usedArcs {
+			if a.Label == f {
+				arc = a
+				v.Arcs = append(v.Arcs, arc)
+				isNew = true
+				if c.nonMonotonicInsertNest > 0 {
+					a.nonMonotonicInsertGen = c.nonMonotonicGeneration
+				}
+				break
+			}
 		}
 	}
-	arc = &Vertex{Parent: v, Label: f, arcType: t}
-	v.Arcs = append(v.Arcs, arc)
-	return arc, true
+	if arc == nil {
+		arc = &Vertex{Parent: v, Label: f}
+		v.Arcs = append(v.Arcs, arc)
+		isNew = true
+		if c.nonMonotonicInsertNest > 0 {
+			arc.nonMonotonicInsertGen = c.nonMonotonicGeneration
+		}
+	}
+	if c.nonMonotonicInsertNest == 0 {
+		arc.nonMonotonicInsertGen = 0
+	}
+	return arc, isNew
 }
 
 func (v *Vertex) Source() ast.Node {
@@ -785,64 +721,17 @@ func (v *Vertex) AddConjunct(c Conjunct) *Bottom {
 		// This is likely a bug in the evaluator and should not happen.
 		return &Bottom{Err: errors.Newf(token.NoPos, "cannot add conjunct")}
 	}
-	if !v.hasConjunct(c) {
-		v.addConjunctUnchecked(c)
-	}
+	v.addConjunct(c)
 	return nil
 }
 
-func (v *Vertex) hasConjunct(c Conjunct) (added bool) {
-	switch c.x.(type) {
-	case *OptionalField, *BulkOptionalField, *Ellipsis:
-	default:
-		v.arcType = arcMember
-	}
+func (v *Vertex) addConjunct(c Conjunct) {
 	for _, x := range v.Conjuncts {
-		// TODO: disregard certain fields from comparison (e.g. Refs)?
-		if x.CloseInfo.closeInfo == c.CloseInfo.closeInfo &&
-			x.x == c.x &&
-			x.Env.Up == c.Env.Up && x.Env.Vertex == c.Env.Vertex {
-			return true
+		if x == c {
+			return
 		}
 	}
-	return false
-}
-
-func (v *Vertex) addConjunctUnchecked(c Conjunct) {
 	v.Conjuncts = append(v.Conjuncts, c)
-	if n := v.state; n != nil {
-		n.conjuncts = append(n.conjuncts, c)
-		// TODO: can we remove notifyConjunct here? This method is only
-		// used if either Unprocessed is 0, in which case there will be no
-		// notification recipients, or for "pushed down" comprehensions,
-		// which should also have been added at an earlier point.
-		n.notifyConjunct(c)
-	}
-}
-
-// addConjunctDynamic adds a conjunct to a vertex and immediately evaluates
-// it, whilst doing the same for any vertices on the notify list, recursively.
-func (n *nodeContext) addConjunctDynamic(c Conjunct) {
-	n.node.Conjuncts = append(n.node.Conjuncts, c)
-	n.addExprConjunct(c, Partial)
-	n.notifyConjunct(c)
-
-}
-
-func (n *nodeContext) notifyConjunct(c Conjunct) {
-	for _, arc := range n.notify {
-		if !arc.hasConjunct(c) {
-			if arc.state == nil {
-				// TODO: continuing here is likely to result in a faulty
-				// (incomplete) configuration. But this may be okay. The
-				// CUE_DEBUG=0 flag disables this assertion.
-				n.ctx.Assertf(n.ctx.pos(), Debug, "unexpected nil state")
-				n.ctx.addErrf(0, n.ctx.pos(), "cannot add to field %v", arc.Label)
-				continue
-			}
-			arc.state.addConjunctDynamic(c)
-		}
-	}
 }
 
 func (v *Vertex) AddStruct(s *StructLit, env *Environment, ci CloseInfo) *StructInfo {
@@ -852,7 +741,7 @@ func (v *Vertex) AddStruct(s *StructLit, env *Environment, ci CloseInfo) *Struct
 		CloseInfo: ci,
 	}
 	for _, t := range v.Structs {
-		if *t == info { // TODO: check for different identity.
+		if *t == info {
 			return t
 		}
 	}
@@ -918,12 +807,7 @@ func (c *Conjunct) Source() ast.Node {
 }
 
 func (c *Conjunct) Field() Node {
-	switch x := c.x.(type) {
-	case *Comprehension:
-		return x.Value
-	default:
-		return c.x
-	}
+	return c.x
 }
 
 // Elem retrieves the Elem form of the contained conjunct.
@@ -942,20 +826,12 @@ func (c *Conjunct) Elem() Elem {
 // Expr retrieves the expression form of the contained conjunct.
 // If it is a field or comprehension, it will return its associated value.
 func (c *Conjunct) Expr() Expr {
-	return ToExpr(c.x)
-}
-
-// ToExpr extracts the underlying expression for a Node. If something is already
-// an Expr, it will return it as is, if it is a field, it will return its value,
-// and for comprehensions it returns the yielded struct.
-func ToExpr(n Node) Expr {
-	switch x := n.(type) {
+	switch x := c.x.(type) {
 	case Expr:
 		return x
+	// TODO: comprehension.
 	case interface{ expr() Expr }:
 		return x.expr()
-	case *Comprehension:
-		return ToExpr(x.Value)
 	default:
 		panic("unreachable")
 	}
diff --git a/vendor/cuelang.org/go/internal/core/adt/comprehension.go b/vendor/cuelang.org/go/internal/core/adt/comprehension.go
index 5fabfd426..804dc3957 100644
--- a/vendor/cuelang.org/go/internal/core/adt/comprehension.go
+++ b/vendor/cuelang.org/go/internal/core/adt/comprehension.go
@@ -14,421 +14,57 @@
 
 package adt
 
-// Comprehension algorithm
-//
-// Comprehensions are expanded for, if, and let clauses that yield 0 or more
-// structs to be embedded in the enclosing list or struct.
-//
-// CUE allows cascading of insertions, as in:
-//
-//     a?: int
-//     b?: int
-//     if a != _|_ {
-//         b: 2
-//     }
-//     if b != _|_ {
-//         c: 3
-//         d: 4
-//     }
-//
-// even though CUE does not allow the result of a comprehension to depend
-// on another comprehension within a single struct. The way this works is that
-// for fields with a fixed prefix path in a comprehension value, the
-// comprehension is assigned to these respective fields.
-//
-// More concretely, the above example is rewritten to:
-//
-//    a?: int
-//    b: if a != _|_ { 2 }
-//    c: if b != _|_ { 3 }
-//    d: if b != _|_ { 4 }
-//
-// where the fields with if clause are only inserted if their condition
-// resolves to true. (Note that this is not valid CUE; it may be in the future.)
-//
-// With this rewrite, any dependencies in comprehension expressions will follow
-// the same rules, more or less, as with normal evaluation.
-//
-// Note that a singe comprehension may be distributed across multiple fields.
-// The evaluator will ensure, however, that a comprehension is only evaluated
-// once.
-//
-//
-// Closedness
-//
-// The comprehension algorithm uses the usual closedness mechanism for marking
-// fields that belong to a struct: it adds the StructLit associated with the
-// comprehension value to the respective arc.
-//
-// One noteworthy point is that the fields of a struct are only legitimate for
-// actual results. For instance, if an if clause evaluates to false, the
-// value is not embedded.
-//
-// To account for this, the comprehension algorithm relies on the fact that
-// the closedness information is computed as a separate step. So even if
-// the StructLit is added early, its fields will only count once it is
-// initialized, which is only done when at least one result is added.
-//
-
-// envComprehension caches the result of a single comprehension.
-type envComprehension struct {
-	comp *Comprehension
-	node *Vertex // The Vertex from which the comprehension originates.
-
-	// runtime-related fields
-
-	err *Bottom
-
-	// envs holds all the environments that define a single "yield" result in
-	// combination with the comprehension struct.
-	envs []*Environment // nil: unprocessed, non-nil: done.
-	done bool           // true once the comprehension has been evaluated
-
-	// StructLits to Init (activate for closedness check)
-	// when at least one value is yielded.
-	structs []*StructLit
-}
-
-// envYield defines a comprehension for a specific field within a comprehension
-// value. Multiple envYields can be associated with a single envComprehension.
-// An envComprehension only needs to be evaluated once for multiple envYields.
 type envYield struct {
-	*envComprehension                // The original comprehension.
-	leaf              *Comprehension // The leaf Comprehension
-
-	// Values specific to the field corresponsing to this envYield
-
-	// This envYield was added to selfComprehensions
-	self bool
-	// This envYield was successfully executed and the resulting conjuncts were
-	// added.
-	inserted bool
-
-	env  *Environment // The adjusted Environment.
-	id   CloseInfo    // CloseInfo for the field.
-	expr Node         // The adjusted expression.
-}
-
-// ValueClause represents a wrapper Environment in a chained clause list
-// to account for the unwrapped struct. It is never created by the compiler
-// and serves as a dynamic element only.
-type ValueClause struct {
-	Node
-
-	// The node in which to resolve lookups in the comprehension's value struct.
-	arc *Vertex
-}
-
-func (v *ValueClause) yield(s *compState) {
-	s.yield(s.ctx.spawn(v.arc))
-}
-
-// insertComprehension registers a comprehension with a node, possibly pushing
-// down its evaluation to the node's children. It will only evaluate one level
-// of fields at a time.
-func (n *nodeContext) insertComprehension(
-	env *Environment,
-	c *Comprehension,
-	ci CloseInfo,
-) {
-	// TODO(perf): this implementation causes the parent's clauses
-	// to be evaluated for each nested comprehension. It would be
-	// possible to simply store the envComprehension of the parent's
-	// result and have each subcomprehension reuse those. This would
-	// also avoid the below allocation and would probably allow us
-	// to get rid of the ValueClause type.
-
-	ec := c.comp
-	if ec == nil {
-		ec = &envComprehension{
-			comp: c,
-			node: n.node,
-
-			err:  nil,   // shut up linter
-			envs: nil,   // shut up linter
-			done: false, // shut up linter
-		}
-	}
-
-	if ec.done && len(ec.envs) == 0 {
-		return
-	}
-
-	x := c.Value
-
-	ci = ci.SpawnEmbed(c)
-	ci.closeInfo.span |= ComprehensionSpan
-
-	var decls []Decl
-	switch v := ToExpr(x).(type) {
-	case *StructLit:
-		numFixed := 0
-		var fields []Decl
-		for _, d := range v.Decls {
-			switch f := d.(type) {
-			case *Field:
-				numFixed++
-
-				arc, _ := n.node.GetArc(n.ctx, f.Label, arcVoid)
-
-				// Create partial comprehension
-				c := &Comprehension{
-					Syntax:  c.Syntax,
-					Clauses: c.Clauses,
-					Value:   f,
-
-					comp:   ec,
-					parent: c,
-					arc:    n.node,
-				}
-
-				arc.addConjunctUnchecked(MakeConjunct(env, c, ci))
-				fields = append(fields, f)
-				// TODO: adjust ci to embed?
-
-				// TODO: this also needs to be done for optional fields.
-
-			case *LetField:
-				// TODO: consider merging this case with the LetField case.
-
-				numFixed++
-
-				arc, _ := n.node.GetArc(n.ctx, f.Label, arcVoid)
-				arc.MultiLet = f.IsMulti
-
-				// Create partial comprehension
-				c := &Comprehension{
-					Syntax:  c.Syntax,
-					Clauses: c.Clauses,
-					Value:   f,
-
-					comp:   ec,
-					parent: c,
-					arc:    n.node,
-				}
-
-				arc.addConjunctUnchecked(MakeConjunct(env, c, ci))
-				fields = append(fields, f)
-
-			default:
-				decls = append(decls, d)
-			}
-		}
-
-		if len(fields) > 0 {
-			// Create a stripped struct that only includes fixed fields.
-			// TODO(perf): this StructLit may be inserted more than once in
-			// the same vertex: once taking the StructLit of the referred node
-			// and once for inserting the Conjunct of the original node.
-			// Is this necessary (given closedness rules), and is this posing
-			// a performance problem?
-			st := v
-			if len(fields) < len(v.Decls) {
-				st = &StructLit{
-					Src:   v.Src,
-					Decls: fields,
-				}
-			}
-			n.node.AddStruct(st, env, ci)
-			switch {
-			case !ec.done:
-				ec.structs = append(ec.structs, st)
-			case len(ec.envs) > 0:
-				st.Init()
-			}
-		}
-
-		switch numFixed {
-		case 0:
-			// Add comprehension as is.
-
-		case len(v.Decls):
-			// No comprehension to add at this level.
-			return
-
-		default:
-			// Create a new StructLit with only the fields that need to be
-			// added at this level.
-			x = &StructLit{Decls: decls}
-		}
-	}
-
-	n.comprehensions = append(n.comprehensions, envYield{
-		envComprehension: ec,
-		leaf:             c,
-		env:              env,
-		id:               ci,
-		expr:             x,
-	})
-}
-
-type compState struct {
-	ctx   *OpContext
-	comp  *Comprehension
-	i     int
-	f     YieldFunc
-	state VertexStatus
-}
-
-// yield evaluates a Comprehension within the given Environment and and calls
-// f for each result.
-func (c *OpContext) yield(
-	node *Vertex, // errors are associated with this node
-	env *Environment, // env for field for which this yield is called
-	comp *Comprehension,
-	state VertexStatus,
-	f YieldFunc, // called for every result
-) *Bottom {
-	s := &compState{
-		ctx:   c,
-		comp:  comp,
-		f:     f,
-		state: state,
-	}
-	y := comp.Clauses[0]
-
-	saved := c.PushState(env, y.Source())
-	if node != nil {
-		defer c.PopArc(c.PushArc(node))
-	}
-
-	s.i++
-	y.yield(s)
-	s.i--
-
-	return c.PopState(saved)
+	comp *Comprehension
+	env  *Environment
+	id   CloseInfo
+	err  *Bottom
 }
 
-func (s *compState) yield(env *Environment) (ok bool) {
-	c := s.ctx
-	if s.i >= len(s.comp.Clauses) {
-		s.f(env)
-		return true
-	}
-	dst := s.comp.Clauses[s.i]
-	saved := c.PushState(env, dst.Source())
-
-	s.i++
-	dst.yield(s)
-	s.i--
-
-	if b := c.PopState(saved); b != nil {
-		c.AddBottom(b)
-		return false
-	}
-	return !c.HasErr()
+func (n *nodeContext) insertComprehension(env *Environment, x *Comprehension, ci CloseInfo) {
+	n.comprehensions = append(n.comprehensions, envYield{x, env, ci, nil})
 }
 
-// injectComprehension evaluates and inserts embeddings. It first evaluates all
-// embeddings before inserting the results to ensure that the order of
-// evaluation does not matter.
-func (n *nodeContext) injectComprehensions(allP *[]envYield, allowCycle bool, state VertexStatus) (progress bool) {
+// injectComprehensions evaluates and inserts comprehensions.
+func (n *nodeContext) injectComprehensions(all *[]envYield) (progress bool) {
 	ctx := n.ctx
 
-	all := *allP
-	workRemaining := false
-
-	// We use variables, instead of range, as the list may grow dynamically.
-	for i := 0; i < len(*allP); i++ {
-		all = *allP // update list as long as it is non-empty.
-		d := all[i]
+	k := 0
+	for i := 0; i < len(*all); i++ {
+		d := (*all)[i]
 
-		if d.self && allowCycle {
-			continue
+		sa := []*Environment{}
+		f := func(env *Environment) {
+			sa = append(sa, env)
 		}
 
-		// Compute environments, if needed.
-		if !d.done {
-			var envs []*Environment
-			f := func(env *Environment) {
-				envs = append(envs, env)
-			}
-
-			if err := ctx.yield(d.node, d.env, d.comp, state, f); err != nil {
-				if err.IsIncomplete() {
-					// TODO:  Detect that the nodes are actually equal
-					if allowCycle && err.ForCycle && err.Value == n.node {
-						n.selfComprehensions = append(n.selfComprehensions, d)
-						progress = true
-						all[i].self = true
-						continue
-					}
-					d.err = err
-					workRemaining = true
-
-					// TODO: add this when it can be done without breaking other
-					// things.
-					//
-					// // Add comprehension to ensure incomplete error is inserted.
-					// // This ensures that the error is reported in the Vertex
-					// // where the comprehension was defined, and not just in the
-					// // node below. This, in turn, is necessary to support
-					// // certain logic, like export, that expects to be able to
-					// // detect an "incomplete" error at the first level where it
-					// // is necessary.
-					// n := d.node.getNodeContext(ctx)
-					// n.addBottom(err)
-
-				} else {
-					// continue to collect other errors.
-					d.node.state.addBottom(err)
-					d.done = true
-					progress = true
-				}
-				if d.node != nil {
-					ctx.PopArc(d.node)
-				}
-				continue
-			}
-
-			d.envs = envs
-
-			if len(d.envs) > 0 {
-				for _, s := range d.structs {
-					s.Init()
-				}
+		if err := ctx.Yield(d.env, d.comp, f); err != nil {
+			if err.IsIncomplete() {
+				d.err = err
+				(*all)[k] = d
+				k++
+			} else {
+				// continue to collect other errors.
+				n.addBottom(err)
 			}
-			d.structs = nil
-			d.done = true
-		}
-
-		if all[i].inserted {
 			continue
 		}
-		all[i].inserted = true
-
-		progress = true
 
-		if len(d.envs) == 0 {
+		if len(sa) == 0 {
 			continue
 		}
+		id := d.id.SpawnSpan(d.comp.Clauses, ComprehensionSpan)
 
-		v := n.node
-		for c := d.leaf; c.parent != nil; c = c.parent {
-			v.arcType = arcMember
-			v = c.arc
+		n.ctx.nonMonotonicInsertNest++
+		for _, env := range sa {
+			n.addExprConjunct(Conjunct{env, d.comp.Value, id})
 		}
+		n.ctx.nonMonotonicInsertNest--
+	}
 
-		id := d.id
+	progress = k < len(*all)
 
-		for _, env := range d.envs {
-			env = linkChildren(env, d.leaf)
-			n.addExprConjunct(Conjunct{env, d.expr, id}, state)
-		}
-	}
+	*all = (*all)[:k]
 
-	if !workRemaining {
-		*allP = all[:0] // Signal that all work is done.
-	}
 	return progress
 }
-
-// linkChildren adds environments for the chain of vertices to a result
-// environment.
-func linkChildren(env *Environment, c *Comprehension) *Environment {
-	if c.parent != nil {
-		env = linkChildren(env, c.parent)
-		env = spawn(env, c.arc)
-	}
-	return env
-}
diff --git a/vendor/cuelang.org/go/internal/core/adt/context.go b/vendor/cuelang.org/go/internal/core/adt/context.go
index b15d56c09..e7a6412be 100644
--- a/vendor/cuelang.org/go/internal/core/adt/context.go
+++ b/vendor/cuelang.org/go/internal/core/adt/context.go
@@ -28,7 +28,6 @@ import (
 
 	"cuelang.org/go/cue/ast"
 	"cuelang.org/go/cue/errors"
-	"cuelang.org/go/cue/stats"
 	"cuelang.org/go/cue/token"
 )
 
@@ -38,17 +37,15 @@ import (
 var Debug bool = os.Getenv("CUE_DEBUG") != "0"
 
 // Verbosity sets the log level. There are currently only two levels:
-//
-//	0: no logging
-//	1: logging
+//   0: no logging
+//   1: logging
 var Verbosity int
 
 // DebugSort specifies that arcs be sorted consistently between implementations.
-//
-//	0: default
-//	1: sort by Feature: this should be consistent between implementations where
-//		   there is no change in the compiler and indexing code.
-//	2: alphabetical
+// 0: default
+// 1: sort by Feature: this should be consistent between implementations where
+//    there is no change in the compiler and indexing code.
+// 2: alphabetical
 var DebugSort int
 
 func DebugSortArcs(c *OpContext, n *Vertex) {
@@ -153,18 +150,6 @@ func (c *OpContext) Logf(v *Vertex, format string, args ...interface{}) {
 	_ = log.Output(2, s)
 }
 
-// PathToString creates a pretty-printed path of the given list of features.
-func (c *OpContext) PathToString(r Runtime, path []Feature) string {
-	var b strings.Builder
-	for i, f := range path {
-		if i > 0 {
-			b.WriteByte('.')
-		}
-		b.WriteString(f.SelectorString(c))
-	}
-	return b.String()
-}
-
 // Runtime defines an interface for low-level representation conversion and
 // lookup.
 type Runtime interface {
@@ -205,21 +190,21 @@ func New(v *Vertex, cfg *Config) *OpContext {
 	return ctx
 }
 
-// An OpContext implements CUE's unification operation. It only
-// operates on values that are created with the Runtime with which an OpContext
-// is associated. An OpContext is not goroutine safe and only one goroutine may
+// An OpContext implements CUE's unification operation. It's operations only
+// operation on values that are created with the Runtime with which an OpContext
+// is associated. An OpContext is not goroutine save and only one goroutine may
 // use an OpContext at a time.
+//
 type OpContext struct {
 	Runtime
 	Format func(Node) string
 
 	nest int
 
-	stats        stats.Counts
+	stats        Stats
 	freeListNode *nodeContext
 
 	e         *Environment
-	ci        CloseInfo
 	src       ast.Node
 	errs      *Bottom
 	positions []Node // keep track of error positions
@@ -229,6 +214,11 @@ type OpContext struct {
 	// structural cycle errors.
 	vertex *Vertex
 
+	nonMonotonicLookupNest int32
+	nonMonotonicRejectNest int32
+	nonMonotonicInsertNest int32
+	nonMonotonicGeneration int32
+
 	// These fields are used associate scratch fields for computing closedness
 	// of a Vertex. These fields could have been included in StructInfo (like
 	// Tomabechi's unification algorithm), but we opted for an indirection to
@@ -243,7 +233,7 @@ type OpContext struct {
 
 	// inDisjunct indicates that non-monotonic checks should be skipped.
 	// This is used if we want to do some extra work to eliminate disjunctions
-	// early. The result of unification should be thrown away if this check is
+	// early. The result of unificantion should be thrown away if this check is
 	// used.
 	//
 	// TODO: replace this with a mechanism to determine the correct set (per
@@ -253,21 +243,8 @@ type OpContext struct {
 	// inConstaint overrides inDisjunct as field matching should always be
 	// enabled.
 	inConstraint int
-
-	// inValidator defines whether full evaluation need to be enforced, for
-	// instance when comparing against bottom.
-	inValidator int
-
-	// The current call is a validator. A builtin may return a boolean false
-	// along with an error message describing a validation error. If the latter
-	// is wrapped in an internal.ValidationError, it will only be interpreted
-	// as an error if this is true.
-	// TODO: strictly separate validators and functions.
-	IsValidator bool
 }
 
-func (c *OpContext) CloseInfo() CloseInfo { return c.ci }
-
 func (n *nodeContext) skipNonMonotonicChecks() bool {
 	if n.ctx.inConstraint > 0 {
 		return false
@@ -304,29 +281,41 @@ func (c *OpContext) pos() token.Pos {
 }
 
 func (c *OpContext) spawn(node *Vertex) *Environment {
-	return spawn(c.e, node)
-}
-
-func spawn(env *Environment, node *Vertex) *Environment {
+	node.Parent = c.e.Vertex // TODO: Is this necessary?
 	return &Environment{
-		Up:     env,
+		Up:     c.e,
 		Vertex: node,
+
+		// Copy cycle data.
+		Cyclic: c.e.Cyclic,
+		Deref:  c.e.Deref,
+		Cycles: c.e.Cycles,
 	}
 }
 
 func (c *OpContext) Env(upCount int32) *Environment {
-	return c.e.up(upCount)
+	e := c.e
+	for ; upCount > 0; upCount-- {
+		e = e.Up
+	}
+	return e
 }
 
 func (c *OpContext) relNode(upCount int32) *Vertex {
-	e := c.e.up(upCount)
+	e := c.e
+	for ; upCount > 0; upCount-- {
+		e = e.Up
+	}
 	c.Unify(e.Vertex, Partial)
 	return e.Vertex
 }
 
 func (c *OpContext) relLabel(upCount int32) Feature {
 	// locate current label.
-	e := c.e.up(upCount)
+	e := c.e
+	for ; upCount > 0; upCount-- {
+		e = e.Up
+	}
 	return e.DynamicLabel
 }
 
@@ -404,14 +393,12 @@ type frame struct {
 	env *Environment
 	err *Bottom
 	src ast.Node
-	ci  CloseInfo
 }
 
 func (c *OpContext) PushState(env *Environment, src ast.Node) (saved frame) {
 	saved.env = c.e
 	saved.err = c.errs
 	saved.src = c.src
-	saved.ci = c.ci
 
 	c.errs = nil
 	if src != nil {
@@ -422,30 +409,11 @@ func (c *OpContext) PushState(env *Environment, src ast.Node) (saved frame) {
 	return saved
 }
 
-func (c *OpContext) PushConjunct(x Conjunct) (saved frame) {
-	src := x.Expr().Source()
-
-	saved.env = c.e
-	saved.err = c.errs
-	saved.src = c.src
-	saved.ci = c.ci
-
-	c.errs = nil
-	if src != nil {
-		c.src = src
-	}
-	c.e = x.Env
-	c.ci = x.CloseInfo
-
-	return saved
-}
-
 func (c *OpContext) PopState(s frame) *Bottom {
 	err := c.errs
 	c.e = s.env
 	c.errs = s.err
 	c.src = s.src
-	c.ci = s.ci
 	return err
 }
 
@@ -466,14 +434,10 @@ func (c *OpContext) PopArc(saved *Vertex) {
 //
 // Should only be used to insert Conjuncts. TODO: perhaps only return Conjuncts
 // and error.
-func (c *OpContext) Resolve(x Conjunct, r Resolver) (*Vertex, *Bottom) {
-	return c.resolveState(x, r, Finalized)
-}
-
-func (c *OpContext) resolveState(x Conjunct, r Resolver, state VertexStatus) (*Vertex, *Bottom) {
-	s := c.PushConjunct(x)
+func (c *OpContext) Resolve(env *Environment, r Resolver) (*Vertex, *Bottom) {
+	s := c.PushState(env, r.Source())
 
-	arc := r.resolve(c, state)
+	arc := r.resolve(c, Partial)
 
 	err := c.PopState(s)
 	if err != nil {
@@ -489,21 +453,6 @@ func (c *OpContext) resolveState(x Conjunct, r Resolver, state VertexStatus) (*V
 	return arc, err
 }
 
-// Lookup looks up r in env without further resolving the value.
-func (c *OpContext) Lookup(env *Environment, r Resolver) (*Vertex, *Bottom) {
-	s := c.PushState(env, r.Source())
-
-	arc := r.resolve(c, Partial)
-
-	err := c.PopState(s)
-
-	if arc != nil {
-		arc = arc.Indirect()
-	}
-
-	return arc, err
-}
-
 // Validate calls validates value for the given validator.
 //
 // TODO(errors): return boolean instead: only the caller has enough information
@@ -520,6 +469,18 @@ func (c *OpContext) Validate(check Validator, value Value) *Bottom {
 	return err
 }
 
+// Yield evaluates a Yielder and calls f for each result.
+func (c *OpContext) Yield(env *Environment, comp *Comprehension, f YieldFunc) *Bottom {
+	y := comp.Clauses
+
+	s := c.PushState(env, y.Source())
+
+	y.yield(c, f)
+
+	return c.PopState(s)
+
+}
+
 // Concrete returns the concrete value of x after evaluating it.
 // msg is used to mention the context in which an error occurred, if any.
 func (c *OpContext) Concrete(env *Environment, x Expr, msg interface{}) (result Value, complete bool) {
@@ -612,9 +573,8 @@ func (c *OpContext) Evaluate(env *Environment, x Expr) (result Value, complete b
 	return val, true
 }
 
-func (c *OpContext) evaluateRec(v Conjunct, state VertexStatus) Value {
-	x := v.Expr()
-	s := c.PushConjunct(v)
+func (c *OpContext) evaluateRec(env *Environment, x Expr, state VertexStatus) Value {
+	s := c.PushState(env, x.Source())
 
 	val := c.evalState(x, state)
 	if val == nil {
@@ -633,8 +593,8 @@ func (c *OpContext) evaluateRec(v Conjunct, state VertexStatus) Value {
 // value evaluates expression v within the current environment. The result may
 // be nil if the result is incomplete. value leaves errors untouched to that
 // they can be collected by the caller.
-func (c *OpContext) value(x Expr, state VertexStatus) (result Value) {
-	v := c.evalState(x, state)
+func (c *OpContext) value(x Expr) (result Value) {
+	v := c.evalState(x, Partial)
 
 	v, _ = c.getDefault(v)
 	v = Unwrap(v)
@@ -667,7 +627,13 @@ func (c *OpContext) evalState(v Expr, state VertexStatus) (result Value) {
 
 		// TODO: remove this when we handle errors more principally.
 		if b, ok := result.(*Bottom); ok {
-			result = c.wrapCycleError(c.src, b)
+			if c.src != nil &&
+				b.Code == CycleError &&
+				len(errors.Positions(b.Err)) == 0 {
+				bb := *b
+				bb.Err = errors.Wrapf(b.Err, c.src.Pos(), "")
+				result = &bb
+			}
 			if c.errs != result {
 				c.errs = CombineErrors(c.src, c.errs, result)
 			}
@@ -683,7 +649,7 @@ func (c *OpContext) evalState(v Expr, state VertexStatus) (result Value) {
 		return x
 
 	case Evaluator:
-		v := x.evaluate(c, state)
+		v := x.evaluate(c)
 		return v
 
 	case Resolver:
@@ -695,15 +661,7 @@ func (c *OpContext) evalState(v Expr, state VertexStatus) (result Value) {
 			return nil
 		}
 
-		// Save the old CloseInfo and restore after evaluate to avoid detecting
-		// spurious cycles.
-		saved := c.ci
-		if n := arc.state; n != nil {
-			c.ci, _ = n.markCycle(arc, nil, x, c.ci)
-		}
-		c.ci.Inline = true
-		v := c.evaluate(arc, x, state)
-		c.ci = saved
+		v := c.evaluate(arc, state)
 		return v
 
 	default:
@@ -712,22 +670,10 @@ func (c *OpContext) evalState(v Expr, state VertexStatus) (result Value) {
 	}
 }
 
-// wrapCycleError converts the sentinel cycleError in a concrete one with
-// position information.
-func (c *OpContext) wrapCycleError(src ast.Node, b *Bottom) *Bottom {
-	if src != nil &&
-		b.Code == CycleError &&
-		len(errors.Positions(b.Err)) == 0 {
-		bb := *b
-		bb.Err = errors.Wrapf(b.Err, src.Pos(), "")
-		b = &bb
-	}
-	return b
-}
-
 // unifyNode returns a possibly partially evaluated node value.
 //
 // TODO: maybe return *Vertex, *Bottom
+//
 func (c *OpContext) unifyNode(v Expr, state VertexStatus) (result Value) {
 	savedSrc := c.src
 	c.src = v.Source()
@@ -738,8 +684,17 @@ func (c *OpContext) unifyNode(v Expr, state VertexStatus) (result Value) {
 		c.errs = CombineErrors(c.src, c.errs, err)
 
 		if v, ok := result.(*Vertex); ok {
-			if b, _ := v.BaseValue.(*Bottom); b != nil && !b.IsIncomplete() {
-				result = b
+			if b, _ := v.BaseValue.(*Bottom); b != nil {
+				switch b.Code {
+				case IncompleteError:
+				case CycleError:
+					if state == Partial {
+						break
+					}
+					fallthrough
+				default:
+					result = b
+				}
 			}
 		}
 
@@ -766,7 +721,7 @@ func (c *OpContext) unifyNode(v Expr, state VertexStatus) (result Value) {
 		return x
 
 	case Evaluator:
-		v := x.evaluate(c, state)
+		v := x.evaluate(c)
 		return v
 
 	case Resolver:
@@ -779,6 +734,14 @@ func (c *OpContext) unifyNode(v Expr, state VertexStatus) (result Value) {
 		}
 
 		if v.isUndefined() || state > v.status {
+			// Keep a minimum state of AllArcs.
+			// TODO: AllArcs may still not be achieved if a node is currently
+			// evaluating.
+			state := state
+			if state < AllArcs {
+				state = AllArcs
+			}
+			// Use node itself to allow for cycle detection.
 			c.Unify(v, state)
 		}
 
@@ -821,7 +784,7 @@ func (c *OpContext) lookup(x *Vertex, pos token.Pos, l Feature, state VertexStat
 				return nil
 			}
 
-		case l.IsDef(), l.IsHidden(), l.IsLet():
+		case l.IsDef(), l.IsHidden():
 
 		default:
 			c.addErrf(0, pos, "invalid list index %s (type string)", l)
@@ -841,7 +804,7 @@ func (c *OpContext) lookup(x *Vertex, pos token.Pos, l Feature, state VertexStat
 			// 	"cannot look up %s in incomplete type %s (type %s)",
 			// 	l, x.Source(), kind)
 			// return nil
-		} else if !l.IsDef() && !l.IsHidden() && !l.IsLet() {
+		} else if !l.IsDef() && !l.IsHidden() {
 			c.addErrf(0, pos,
 				"invalid selector %s for value of type %s", l, kind)
 			return nil
@@ -849,21 +812,46 @@ func (c *OpContext) lookup(x *Vertex, pos token.Pos, l Feature, state VertexStat
 	}
 
 	a := x.Lookup(l)
+	if a != nil {
+		a = a.Indirect()
+	}
 
 	var hasCycle bool
+outer:
+	switch {
+	case c.nonMonotonicLookupNest == 0 && c.nonMonotonicRejectNest == 0:
+	case a != nil:
+		if state == Partial {
+			a.nonMonotonicLookupGen = c.nonMonotonicGeneration
+		}
 
-	if a != nil {
-		// Ensure that a's status is at least of the required level. Otherwise,
-		// ensure that any remaining unprocessed conjuncts are processed by
-		// calling c.Unify(a, Partial). The ensures that need to rely on
-		// hasAllConjuncts, but that are finalized too early, get conjuncts
-		// processed beforehand.
-		if state > a.status {
-			c.Unify(a, state)
-		} else if a.state != nil {
-			c.Unify(a, Partial)
+	case x.state != nil && state == Partial:
+		for _, e := range x.state.exprs {
+			if isCyclePlaceholder(e.err) {
+				hasCycle = true
+			}
 		}
-	} else {
+		for _, a := range x.state.usedArcs {
+			if a.Label == l {
+				a.nonMonotonicLookupGen = c.nonMonotonicGeneration
+				if c.nonMonotonicRejectNest > 0 {
+					a.nonMonotonicReject = true
+				}
+				break outer
+			}
+		}
+		a := &Vertex{Label: l, nonMonotonicLookupGen: c.nonMonotonicGeneration}
+		if c.nonMonotonicRejectNest > 0 {
+			a.nonMonotonicReject = true
+		}
+		x.state.usedArcs = append(x.state.usedArcs, a)
+	}
+
+	if a != nil && state > a.status {
+		c.Unify(a, state)
+	}
+
+	if a == nil {
 		if x.state != nil {
 			for _, e := range x.state.exprs {
 				if isCyclePlaceholder(e.err) {
@@ -872,14 +860,7 @@ func (c *OpContext) lookup(x *Vertex, pos token.Pos, l Feature, state VertexStat
 			}
 		}
 		code := IncompleteError
-		// As long as we have incomplete information, we cannot mark the
-		// inability to look up a field as "final", as it may resolve down the
-		// line.
-		permanent := x.status > Conjuncts
-		if m, _ := x.BaseValue.(*ListMarker); m != nil && !m.IsOpen {
-			permanent = true
-		}
-		if (state > Partial || permanent) && !x.Accept(c, l) {
+		if !x.Accept(c, l) {
 			code = 0
 		} else if hasCycle {
 			code = CycleError
@@ -890,32 +871,21 @@ func (c *OpContext) lookup(x *Vertex, pos token.Pos, l Feature, state VertexStat
 
 		// TODO(errors): add path reference and make message
 		//       "undefined field %s in %s"
-		var err *ValueError
 		if l.IsInt() {
-			err = c.NewPosf(pos, "index out of range [%d] with length %d",
+			c.addErrf(code, pos, "index out of range [%d] with length %d",
 				l.Index(), len(x.Elems()))
 		} else {
 			if code != 0 && x.IsOptional(l) {
-				err = c.NewPosf(pos,
+				c.addErrf(code, pos,
 					"cannot reference optional field: %s", label)
 			} else {
-				err = c.NewPosf(pos, "undefined field: %s", label)
+				c.addErrf(code, pos, "undefined field: %s", label)
 			}
 		}
-		c.AddBottom(&Bottom{
-			Code:      code,
-			Permanent: permanent,
-			Err:       err,
-		})
 	}
 	return a
 }
 
-func (c *OpContext) undefinedFieldError(v *Vertex, code ErrorCode) {
-	label := v.Label.SelectorString(c)
-	c.addErrf(code, c.pos(), "undefined field: %s", label)
-}
-
 func (c *OpContext) Label(src Expr, x Value) Feature {
 	return labelFromValue(c, src, x)
 }
@@ -1030,15 +1000,8 @@ func (c *OpContext) node(orig Node, x Expr, scalar bool, state VertexStatus) *Ve
 	return node
 }
 
-// Elems returns the evaluated elements of a list.
+// Elems returns the elements of a list.
 func (c *OpContext) Elems(v Value) []*Vertex {
-	list := c.list(v)
-	list.Finalize(c)
-	return list.Elems()
-}
-
-// RawElems returns the elements of the list without evaluating them.
-func (c *OpContext) RawElems(v Value) []*Vertex {
 	list := c.list(v)
 	return list.Elems()
 }
@@ -1293,11 +1256,7 @@ func (c *OpContext) newBool(b bool) Value {
 }
 
 func (c *OpContext) newList(src ast.Node, parent *Vertex) *Vertex {
-	return &Vertex{
-		Parent:    parent,
-		BaseValue: &ListMarker{},
-		IsDynamic: true,
-	}
+	return &Vertex{Parent: parent, BaseValue: &ListMarker{}}
 }
 
 // Str reports a debug string of x.
@@ -1313,7 +1272,6 @@ func (c *OpContext) NewList(values ...Value) *Vertex {
 	// TODO: consider making this a literal list instead.
 	list := &ListLit{}
 	v := &Vertex{
-		IsDynamic: true,
 		Conjuncts: []Conjunct{{Env: nil, x: list}},
 	}
 
diff --git a/vendor/cuelang.org/go/internal/core/adt/cycle.go b/vendor/cuelang.org/go/internal/core/adt/cycle.go
deleted file mode 100644
index 5a3043e3b..000000000
--- a/vendor/cuelang.org/go/internal/core/adt/cycle.go
+++ /dev/null
@@ -1,525 +0,0 @@
-// Copyright 2022 CUE Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package adt
-
-// Cycle detection:
-//
-// - Current algorithm does not allow for early non-cyclic conjunct detection.
-// - Record possibly cyclic references.
-// - Mark as cyclic if no evidence is found.
-// - Note that this also activates the same reference in other (parent) conjuncts.
-
-// TODO:
-// - get rid of nodeContext.{hasCycle|hasNonCycle}.
-// - compiler support for detecting cross-pattern references.
-// - handle propagation of cyclic references to root across disjunctions.
-
-// CYCLE DETECTION ALGORITHM
-//
-// BACKGROUND
-//
-// The cycle detection is inspired by the cycle detection used by Tomabechi's
-// [Tomabechi COLING 1992] and Van Lohuizen's [Van Lohuizen ACL 2000] graph
-// unification algorithms.
-//
-// Unlike with traditional graph unification, however, CUE uses references,
-// which, unlike node equivalence, are unidirectional. This means that the
-// technique to track equivalence through dereference, as common in graph
-// unification algorithms like Tomabechi's, does not work unaltered.
-//
-// The unidirectional nature of references imply that each reference equates a
-// facsimile of the value it points to. This renders the original approach of
-// node-pointer equivalence useless.
-//
-//
-// PRINCIPLE OF ALGORITHM
-//
-// The solution for CUE is based on two observations:
-//
-// - the CUE algorithm tracks all conjuncts that define a node separately, -
-// accumulating used references on a per-conjunct basis causes duplicate
-//   references to uniquely identify cycles.
-//
-// A structural cycle, as defined by the spec, can then be detected if all
-// conjuncts are marked as a cycle.
-//
-// References are accumulated as follows:
-//
-// 1. If a conjunct is a reference the reference is associated with that
-//    conjunct as well as the conjunct corresponding to the value it refers to.
-// 2. If a conjunct is a struct (including lists), its references are associated
-//    with all embedded values and fields.
-//
-// To narrow down the specifics of the reference-based cycle detection, let us
-// explore structural cycles in a bit more detail.
-//
-//
-// STRUCTURAL CYCLES
-//
-// See the language specification for a higher-level and more complete overview.
-//
-// We have to define when a cycle is detected. CUE implementations MUST report
-// an error upon a structural cycle, and SHOULD report cycles at the shortest
-// possible paths at which they occur, but MAY report these at deeper paths. For
-// instance, the following CUE has a structural cycle
-//
-//     f: g: f
-//
-// The shortest path at which the cycle can be reported is f.g, but as all
-// failed configurations are logically equal, it is fine for implementations to
-// report them at f.g.g, for instance.
-//
-// It is not, however, correct to assume that a reference to a parent is always
-// a cycle. Consider this case:
-//
-//     a: [string]: b: a
-//
-// Even though reference `a` refers to a parent node, the cycle needs to be fed
-// by a concrete field in struct `a` to persist, meaning it cannot result in a
-// cycle as defined in the spec as it is defined here. Note however, that a
-// specialization of this configuration _can_ result in a cycle. Consider
-//
-//     a: [string]: b: a
-//     a: c: _
-//
-// Here reference `a` is guaranteed to result in a structural cycle, as field
-// `c` will match the pattern constraint unconditionally.
-//
-// In other words, it is not possible to exclude tracking references across
-// pattern constraints from cycle checking.
-//
-// It is tempting to try to find a complete set of these edge cases with the aim
-// to statically determine cases in which this occurs. But as [Carpenter 1992]
-// demonstrates, it is possible for cycles to be created as a result of unifying
-// two graphs that are themselves acyclic. The following example is a
-// translation of Carpenters example to CUE:
-//
-//     y: {
-//         f: h: g
-//         g: _
-//     }
-//     x: {
-//         f: _
-//         g: f
-//     }
-//
-// Even though the above contains no cycles, the result of `x & y` is cyclic:
-//
-//     f: h: g
-//     g: f
-//
-// This means that, in practice, cycle detection has at least partially a
-// dynamic component to it.
-//
-//
-// ABSTRACT ALGORITHM
-//
-// The algorithm is described declaratively by defining what it means for a
-// field to have a structural cycle. In the below, a _reference_ is uniquely
-// identified by the pointer identity of a Go Resolver instance.
-//
-// Cycles are tracked on a per-conjunct basis and are not aggregated per Vertex:
-// administrative information is only passed on from parent to child conjunct.
-//
-// A conjunct is a _parent_ of another conjunct if is a conjunct of one of the
-// non-optional fields of the conjunct. For instance, conjunct `x` with value
-// `{b: y & z}`, is a parent of conjunct `y` as well as `z`. Within field `b`,
-// the conjuncts `y` and `z` would be tracked individually, though.
-//
-// A conjunct is _associated with a reference_ if its value was obtained by
-// evaluating a reference. Note that a conjunct may be associated with many
-// references if its evaluation requires evaluating a chain of references. For
-// instance, consider
-//
-//    a: {x: d}
-//    b: a
-//    c: b & e
-//    d: y: 1
-//
-// the first conjunct of field `c` (reference `b`) has the value `{x: y: 1}` and
-// is associated with references `b` and `a`.
-//
-// The _tracked references_ of a conjunct are all references that are associated
-// with it or any of its ancestors (parents of parents). For instance, the
-// tracked references of conjunct `b.x` of field `c.x` are `a`, `b`, and `d`.
-//
-// A conjunct is a violating cycle if it is a reference that:
-//  - occurs in the tracked references of the conjunct, or
-//  - directly refers to a parent node of the conjunct.
-//
-// A conjunct is cyclic if it is a violating cycle or if any of its ancestors
-// are a violating cycle.
-//
-// A field has a structural cycle if it is composed of at least one conjunct
-// that is a violating cycle and no conjunct that is not cyclic.
-//
-// Note that a field can be composed of only cyclic conjuncts while still not be
-// structural cycle: as long as there are no conjuncts that are a violating
-// cycle, it is not a structural cycle. This is important for the following
-//     case:
-//
-//         a: [string]: b: a
-//         x: a
-//         x: c: b: c: {}
-//
-// Here, reference `a` is never a cycle as the recursive references crosses a
-// pattern constraint that only instantiates if it is unified with something
-// else.
-//
-//
-// DISCUSSION
-//
-// The goal of conjunct cycle marking algorithm is twofold: - mark conjuncts
-// that are proven to propagate indefinitely - mark them as early as possible
-// (shortest CUE path).
-//
-// TODO: Prove all cyclic conjuncts will eventually be marked as cyclic.
-//
-// TODO:
-//   - reference marks whether it crosses a pattern, improving the case
-//     a: [string]: b: c: b
-//     This requires a compile-time detection mechanism.
-//
-//
-// REFERENCES
-// [Tomabechi COLING 1992]: https://aclanthology.org/C92-2068
-//     Hideto Tomabechi. 1992. Quasi-Destructive Graph Unification with
-//     Structure-Sharing. In COLING 1992 Volume 2: The 14th International
-//     Conference on Computational Linguistics.
-//
-// [Van Lohuizen ACL 2000]: https://aclanthology.org/P00-1045/
-//     Marcel P. van Lohuizen. 2000. "Memory-Efficient and Thread-Safe
-//     Quasi-Destructive Graph Unification". In Proceedings of the 38th Annual
-//     Meeting of the Association for Computational Linguistics, pages 352–359,
-//     Hong Kong. Association for Computational Linguistics.
-//
-// [Carpenter 1992]:
-//     Bob Carpenter, "The logic of typed feature structures."
-//     Cambridge University Press, ISBN:0-521-41932-8
-
-type CycleInfo struct {
-	// IsCyclic indicates whether this conjunct, or any of its ancestors,
-	// had a violating cycle.
-	IsCyclic bool
-
-	// Inline is used to detect expressions referencing themselves, for instance:
-	//     {x: out, out: x}.out
-	Inline bool
-
-	// TODO(perf): pack this in with CloseInfo. Make an uint32 pointing into
-	// a buffer maintained in OpContext, using a mark-release mechanism.
-	Refs *RefNode
-}
-
-// A RefNode is a linked list of associated references.
-type RefNode struct {
-	Ref Resolver
-	Arc *Vertex // Ref points to this Vertex
-
-	// Node is the Vertex of which Ref is evaluated as a conjunct.
-	// If there is a cyclic reference (not structural cycle), then
-	// the reference will have the same node. This allows detecting reference
-	// cycles for nodes referring to nodes with an evaluation cycle
-	// (mode tracked to Evaluating status). Examples:
-	//
-	//      a: x
-	//      Y: x
-	//      x: {Y}
-	//
-	// and
-	//
-	//      Y: x.b
-	//      a: x
-	//      x: b: {Y} | null
-	//
-	// In both cases there are not structural cycles and thus need to be
-	// distinguised from regular structural cycles.
-	Node *Vertex
-
-	Next  *RefNode
-	Depth int32
-}
-
-// cyclicConjunct is used in nodeContext to postpone the computation of
-// cyclic conjuncts until a non-cyclic conjunct permits it to be processed.
-type cyclicConjunct struct {
-	c   Conjunct
-	arc *Vertex // cached Vertex
-}
-
-// markCycle checks whether the reference x is cyclic. There are two cases:
-//  1. it was previously used in this conjunct, and
-//  2. it directly references a parent node.
-//
-// Other inputs:
-//
-//	arc      the reference to which x points
-//	env, ci  the components of the Conjunct from which x originates
-//
-// A cyclic node is added to a queue for later processing if no evidence of a
-// non-cyclic node has so far been found. updateCyclicStatus processes delayed
-// nodes down the line once such evidence is found.
-//
-// If a cycle is the result of "inline" processing (an expression referencing
-// itself), an error is reported immediately.
-//
-// It returns the CloseInfo with tracked cyclic conjuncts updated, and
-// whether or not its processing should be skipped, which is the case either if
-// the conjunct seems to be fully cyclic so far or if there is a valid reference
-// cycle.
-func (n *nodeContext) markCycle(arc *Vertex, env *Environment, x Resolver, ci CloseInfo) (_ CloseInfo, skip bool) {
-	// TODO(perf): this optimization can work if we also check for any
-	// references pointing to arc within arc. This can be done with compiler
-	// support. With this optimization, almost all references could avoid cycle
-	// checking altogether!
-	// if arc.status == Finalized && arc.cyclicReferences == nil {
-	//  return v, false
-	// }
-
-	// Check whether the reference already occurred in the list, signaling
-	// a potential cycle.
-	found := false
-	depth := int32(0)
-	for r := ci.Refs; r != nil; r = r.Next {
-		if r.Ref != x {
-			continue
-		}
-
-		// A reference that is within a graph that is being evaluated
-		// may repeat with a different arc and will point to a
-		// non-finalized arc. A repeating reference that points outside the
-		// graph will always be the same address. Hence, if this is a
-		// finalized arc with a different address, it resembles a reference that
-		// is included through a different path and is not a cycle.
-		if r.Arc != arc && arc.status == Finalized {
-			continue
-		}
-
-		// For dynamically created structs we mark this as an error. Otherwise
-		// there is only an error if we have visited the arc before.
-		if ci.Inline && (arc.IsDynamic || r.Arc == arc) {
-			n.reportCycleError()
-			return ci, true
-		}
-
-		// We have a reference cycle, as distinguished from a structural
-		// cycle. Reference cycles represent equality, and thus are equal
-		// to top. We can stop processing here.
-		if r.Node == n.node {
-			return ci, true
-		}
-
-		depth = r.Depth
-		found = true
-
-		// Mark all conjuncts of this Vertex that refer to the same node as
-		// cyclic. This is an extra safety measure to ensure that two conjuncts
-		// cannot work in tandom to circumvent a cycle. It also tightens
-		// structural cycle detection in some cases. Late detection of cycles
-		// can result in a lot of redundant work.
-		//
-		// TODO: this loop is not on a critical path, but it may be evaluated
-		// if it is worthy keeping at some point.
-		for i, c := range n.node.Conjuncts {
-			if c.CloseInfo.IsCyclic {
-				continue
-			}
-			for rr := c.CloseInfo.Refs; rr != nil; rr = rr.Next {
-				// TODO: Is it necessary to find another way to find
-				// "parent" conjuncts? This mechanism seems not entirely
-				// accurate. Maybe a pointer up to find the root and then
-				// "spread" downwards?
-				if r.Ref == x && r.Arc == rr.Arc {
-					n.node.Conjuncts[i].CloseInfo.IsCyclic = true
-					break
-				}
-			}
-		}
-
-		break
-	}
-
-	// The code in this switch statement registers structural cycles caught
-	// through EvaluatingArcs to the root of the cycle. This way, any node
-	// referencing this value can track these nodes early. This is mostly an
-	// optimization to shorten the path for which structural cycles are
-	// detected, which may be critical for performance.
-outer:
-	switch arc.status {
-	case EvaluatingArcs: // also  Evaluating?
-		// The reference may already be there if we had no-cyclic structure
-		// invalidating the cycle.
-		for r := arc.cyclicReferences; r != nil; r = r.Next {
-			if r.Ref == x {
-				break outer
-			}
-		}
-
-		arc.cyclicReferences = &RefNode{
-			Arc:  arc,
-			Ref:  x,
-			Next: arc.cyclicReferences,
-		}
-
-	case Finalized:
-		// Insert cyclic references from found arc, if any.
-		for r := arc.cyclicReferences; r != nil; r = r.Next {
-			if r.Ref == x {
-				// We have detected a cycle, with the only exception if arc is
-				// a disjunction, as evaluation always stops at unresolved
-				// disjunctions.
-				if _, ok := arc.BaseValue.(*Disjunction); !ok {
-					found = true
-				}
-			}
-			ci.Refs = &RefNode{
-				Arc:  r.Arc,
-				Node: n.node,
-
-				Ref:   x,
-				Next:  ci.Refs,
-				Depth: n.depth,
-			}
-		}
-	}
-
-	// NOTE: we need to add a tracked reference even if arc is not cyclic: it
-	// may still cause a cycle that does not refer to a parent node. For
-	// instance:
-	//
-	//      y: [string]: b: y
-	//      x: y
-	//      x: c: x
-	// ->
-	//      x: [string]: b: y
-	//      x: c: b: y
-	//      x: c: [string]: b: y
-	//      x: c: b: b: y
-	//      x: c: b: [string]: b: y
-	//      x: c: b: b: b: y
-	//      ....       // structural cycle 1
-	//      x: c: c: x // structural cycle 2
-	//
-	// Note that in this example there is a structural cycle at x.c.c, but we
-	// would need go guarantee that cycle is detected before the algorithm
-	// descends into x.c.b.
-	if !found || depth != n.depth {
-		// Adding this in case there is a definite cycle is unnecessary, but
-		// gives somewhat better error messages.
-		// We also need to add the reference again if the depth differs, as
-		// the depth is used for tracking "new structure".
-		ci.Refs = &RefNode{
-			Arc:   arc,
-			Ref:   x,
-			Node:  n.node,
-			Next:  ci.Refs,
-			Depth: n.depth,
-		}
-	}
-
-	if !found && arc.status != EvaluatingArcs {
-		// No cycle.
-		return ci, false
-	}
-
-	alreadyCycle := ci.IsCyclic
-	ci.IsCyclic = true
-
-	// TODO: depth might legitimately be 0 if it is a root vertex.
-	// In the worst case, this may lead to a spurious cycle.
-	// Fix this by ensuring the root vertex starts with a depth of 1, for
-	// instance.
-	if depth > 0 {
-		// Look for evidence of "new structure" to invalidate the cycle.
-		// This is done by checking for non-cyclic conjuncts between the
-		// current vertex up to the ancestor to which the reference points.
-		// Note that the cyclic conjunct may not be marked as such, so we
-		// look for at least one other non-cyclic conjunct if this is the case.
-		upCount := n.depth - depth
-		for p := n.node.Parent; p != nil; p = p.Parent {
-			if upCount--; upCount <= 0 {
-				break
-			}
-			a := p.Conjuncts
-			count := 0
-			for _, c := range a {
-				if !c.CloseInfo.IsCyclic {
-					count++
-				}
-			}
-			if !alreadyCycle {
-				count--
-			}
-			if count > 0 {
-				return ci, false
-			}
-		}
-	}
-
-	n.hasCycle = true
-	if !n.hasNonCycle && env != nil {
-		v := Conjunct{env, x, ci}
-		n.cyclicConjuncts = append(n.cyclicConjuncts, cyclicConjunct{v, arc})
-		return ci, true
-	}
-
-	return ci, false
-}
-
-// updateCyclicStatus looks for proof of non-cyclic conjuncts to override
-// a structural cycle.
-func (n *nodeContext) updateCyclicStatus(c CloseInfo) {
-	if !c.IsCyclic {
-		n.hasNonCycle = true
-		for _, c := range n.cyclicConjuncts {
-			n.addVertexConjuncts(c.c, c.arc, false)
-		}
-		n.cyclicConjuncts = n.cyclicConjuncts[:0]
-	}
-}
-
-func assertStructuralCycle(n *nodeContext) bool {
-	if n.hasCycle && !n.hasNonCycle {
-		n.reportCycleError()
-		return true
-	}
-	return false
-}
-
-func (n *nodeContext) reportCycleError() {
-	n.node.BaseValue = CombineErrors(nil,
-		n.node.Value(),
-		&Bottom{
-			Code:  StructuralCycleError,
-			Err:   n.ctx.Newf("structural cycle"),
-			Value: n.node.Value(),
-			// TODO: probably, this should have the referenced arc.
-		})
-	n.node.Arcs = nil
-}
-
-// makeAnonymousConjunct creates a conjunct that tracks self-references when
-// evaluating an expression.
-//
-// Example:
-// TODO:
-func makeAnonymousConjunct(env *Environment, x Expr, refs *RefNode) Conjunct {
-	return Conjunct{
-		env, x, CloseInfo{CycleInfo: CycleInfo{
-			Inline: true,
-			Refs:   refs,
-		}},
-	}
-}
diff --git a/vendor/cuelang.org/go/internal/core/adt/disjunct.go b/vendor/cuelang.org/go/internal/core/adt/disjunct.go
index 5264e806f..8f2074a40 100644
--- a/vendor/cuelang.org/go/internal/core/adt/disjunct.go
+++ b/vendor/cuelang.org/go/internal/core/adt/disjunct.go
@@ -124,21 +124,14 @@ func (n *nodeContext) expandDisjuncts(
 	parentMode defaultMode, // default mode of this disjunct
 	recursive, last bool) {
 
-	n.ctx.stats.Disjuncts++
-
-	// refNode is used to collect cyclicReferences for all disjuncts to be
-	// passed up to the parent node. Note that because the node in the parent
-	// context is overwritten in the course of expanding disjunction to retain
-	// pointer identity, it is not possible to simply record the refNodes in the
-	// parent directly.
-	var refNode *RefNode
+	n.ctx.stats.DisjunctCount++
 
 	node := n.node
 	defer func() {
 		n.node = node
 	}()
 
-	for n.expandOne(Partial) {
+	for n.expandOne() {
 	}
 
 	// save node to snapShot in nodeContex
@@ -174,6 +167,9 @@ func (n *nodeContext) expandDisjuncts(
 				// Perhaps introduce an Err() method.
 				err = x.ChildErrors
 			}
+			if err.IsIncomplete() {
+				break
+			}
 			if err != nil {
 				parent.disjunctErrs = append(parent.disjunctErrs, err)
 			}
@@ -190,7 +186,7 @@ func (n *nodeContext) expandDisjuncts(
 			n.disjuncts = append(n.disjuncts, n)
 		}
 		if n.node.BaseValue == nil {
-			n.node.BaseValue = n.getValidators(state)
+			n.node.BaseValue = n.getValidators()
 		}
 
 		n.usedDefault = append(n.usedDefault, defaultInfo{
@@ -229,22 +225,11 @@ func (n *nodeContext) expandDisjuncts(
 						cn.node.state = cn
 
 						c := MakeConjunct(d.env, v.Val, d.cloneID)
-						cn.addExprConjunct(c, state)
+						cn.addExprConjunct(c)
 
 						newMode := mode(d.hasDefaults, v.Default)
 
 						cn.expandDisjuncts(state, n, newMode, true, last)
-
-						// Record the cyclicReferences of the conjunct in the
-						// parent list.
-						// TODO: avoid the copy. It should be okay to "steal"
-						// this list and avoid the copy. But this change is best
-						// done in a separate CL.
-						for r := n.node.cyclicReferences; r != nil; r = r.Next {
-							s := *r
-							s.Next = refNode
-							refNode = &s
-						}
 					}
 
 				case d.value != nil:
@@ -258,13 +243,6 @@ func (n *nodeContext) expandDisjuncts(
 						newMode := mode(d.hasDefaults, i < d.value.NumDefaults)
 
 						cn.expandDisjuncts(state, n, newMode, true, last)
-
-						// See comment above.
-						for r := n.node.cyclicReferences; r != nil; r = r.Next {
-							s := *r
-							s.Next = refNode
-							refNode = &s
-						}
 					}
 				}
 			}
@@ -415,14 +393,6 @@ func (n *nodeContext) expandDisjuncts(
 
 		n.disjuncts = n.disjuncts[:0]
 	}
-
-	// Record the refNodes in the parent.
-	for r := refNode; r != nil; {
-		next := r.Next
-		r.Next = parent.node.cyclicReferences
-		parent.node.cyclicReferences = r
-		r = next
-	}
 }
 
 func (n *nodeContext) makeError() {
@@ -558,14 +528,12 @@ func (n *nodeContext) disjunctError() (errs errors.Error) {
 	} else {
 		disjuncts = errors.Sanitize(disjuncts)
 		k := len(errors.Errors(disjuncts))
-		if k == 1 {
-			return disjuncts
-		}
 		// prefix '-' to sort to top
 		errs = ctx.Newf("%d errors in empty disjunction:", k)
-		errs = errors.Append(errs, disjuncts)
 	}
 
+	errs = errors.Append(errs, disjuncts)
+
 	return errs
 }
 
diff --git a/vendor/cuelang.org/go/internal/core/adt/doc.go b/vendor/cuelang.org/go/internal/core/adt/doc.go
index 2c5989869..26c978e2f 100644
--- a/vendor/cuelang.org/go/internal/core/adt/doc.go
+++ b/vendor/cuelang.org/go/internal/core/adt/doc.go
@@ -18,25 +18,27 @@
 // values that may be used in a certain situation. Concrete types may belong to
 // multiple categories.
 //
-// # Abstract Types
+//
+// Abstract Types
 //
 // The following types describe the a place where a value may be used:
 //
-//	Decl       a value than can be used as a StructLit element.
-//	Elem       a value than can be used as a ListLit element.
-//	Expr       represents an Expr in the CUE grammar.
-//	Value      a fully evaluated value that has no references (except for
-//	           children in composite values).
-//	Node       any of the above values.
+//    Decl       a value than can be used as a StructLit element.
+//    Elem       a value than can be used as a ListLit element.
+//    Expr       represents an Expr in the CUE grammar.
+//    Value      a fully evaluated value that has no references (except for
+//               children in composite values).
+//    Node       any of the above values.
 //
 // The following types categorize nodes by function:
 //
-//	Resolver   a reference to position in the result tree.
-//	Evaluator  evaluates to 1 value.
-//	Yielder    evaluates to 0 or more values.
-//	Validator  validates another value.
+//    Resolver   a reference to position in the result tree.
+//    Evaluator  evaluates to 1 value.
+//    Yielder    evaluates to 0 or more values.
+//    Validator  validates another value.
+//
 //
-// # Reference resolution algorithm
+// Reference resolution algorithm
 //
 // A Resolver is resolved within the context of an Environment. In CUE, a
 // reference is evaluated by substituting it with a copy of the value to which
@@ -46,15 +48,15 @@
 // References that point to outside the referened value will keep referring to
 // their original value.
 //
-//	a: b: {
-//	  c: int
-//	  d: c
-//	  e: f
-//	}
-//	f: 4
-//	g: a.b { // d.c points to inside the referred value, e.f, not.
-//	  c: 3
-//	}
+//      a: b: {
+//        c: int
+//        d: c
+//        e: f
+//      }
+//      f: 4
+//      g: a.b { // d.c points to inside the referred value, e.f, not.
+//        c: 3
+//      }
 //
 // The implementation doesn't actually copy referred values, but rather resolves
 // references with the aid of an Environment. During compile time, each
@@ -65,10 +67,12 @@
 // is the identical for all references within a fields conjunct. Often, an
 // Environment can even be shared among conjuncts.
 //
-// # Values
+//
+// Values
 //
 // Values are fully evaluated expressions. As this means that all references
 // will have been eliminated, Values are fully defined without the need for an
 // Environment. Additionally, Values represent a fully evaluated form, stripped
 // of any comprehensions, optional fields or embeddings.
+//
 package adt
diff --git a/vendor/cuelang.org/go/internal/core/adt/equality.go b/vendor/cuelang.org/go/internal/core/adt/equality.go
index dd2e7c657..cb1d33813 100644
--- a/vendor/cuelang.org/go/internal/core/adt/equality.go
+++ b/vendor/cuelang.org/go/internal/core/adt/equality.go
@@ -68,13 +68,7 @@ func equalVertex(ctx *OpContext, x *Vertex, v Value, flags Flag) bool {
 
 loop1:
 	for _, a := range x.Arcs {
-		if !a.IsDefined(ctx) {
-			continue
-		}
 		for _, b := range y.Arcs {
-			if !b.IsDefined(ctx) {
-				continue
-			}
 			if a.Label == b.Label {
 				if !Equal(ctx, a, b, flags) {
 					return false
@@ -107,10 +101,10 @@ loop1:
 
 // equalClosed tests if x and y have the same set of close information.
 // TODO: the following refinements are possible:
-//   - unify optional fields and equate the optional fields
-//   - do the same for pattern constraints, where the pattern constraints
-//     are collated by pattern equality.
-//   - a further refinement would collate patterns by ranges.
+// - unify optional fields and equate the optional fields
+// - do the same for pattern constraints, where the pattern constraints
+//   are collated by pattern equality.
+// - a further refinement would collate patterns by ranges.
 //
 // For all these refinements it would be necessary to have well-working
 // structure sharing so as to not repeatedly recompute optional arcs.
@@ -124,7 +118,7 @@ outer:
 		if (flags&IgnoreOptional != 0) && !s.StructLit.HasOptional() {
 			continue
 		}
-		if s.span()&DefinitionSpan == 0 {
+		if s.closeInfo == nil || s.closeInfo.span&DefinitionSpan == 0 {
 			if !s.StructLit.HasOptional() {
 				continue
 			}
@@ -145,11 +139,6 @@ func equalTerminal(ctx *OpContext, v, w Value, flags Flag) bool {
 	}
 
 	switch x := v.(type) {
-	case *Bottom:
-		// All errors are logically the same.
-		_, ok := w.(*Bottom)
-		return ok
-
 	case *Num, *String, *Bool, *Bytes, *Null:
 		if b, ok := BinOp(ctx, EqualOp, v, w).(*Bool); ok {
 			return b.B
diff --git a/vendor/cuelang.org/go/internal/core/adt/errors.go b/vendor/cuelang.org/go/internal/core/adt/errors.go
index b2913edd7..d5f6cfc17 100644
--- a/vendor/cuelang.org/go/internal/core/adt/errors.go
+++ b/vendor/cuelang.org/go/internal/core/adt/errors.go
@@ -40,7 +40,7 @@ import (
 
 // ErrorCode indicates the type of error. The type of error may influence
 // control flow. No other aspects of an error may influence control flow.
-type ErrorCode int8
+type ErrorCode int
 
 const (
 	// An EvalError is a fatal evaluation error.
@@ -89,15 +89,10 @@ type Bottom struct {
 	Src ast.Node
 	Err errors.Error
 
-	Code ErrorCode
-	// Permanent indicates whether an incomplete error can be
-	// resolved later without making the configuration more specific.
-	// This may happen when an arc isn't fully resolved yet.
-	Permanent    bool
+	Code         ErrorCode
 	HasRecursive bool
 	ChildError   bool // Err is the error of the child
 	NotExists    bool // This error originated from a failed lookup.
-	ForCycle     bool // this is a for cycle
 	// Value holds the computed value so far in case
 	Value Value
 }
@@ -145,6 +140,7 @@ func isIncomplete(v *Vertex) bool {
 //
 // If x is not already an error, the value is recorded in the error for
 // reference.
+//
 func (v *Vertex) AddChildError(recursive *Bottom) {
 	v.ChildErrors = CombineErrors(nil, v.ChildErrors, recursive)
 	if recursive.IsIncomplete() {
diff --git a/vendor/cuelang.org/go/internal/core/adt/eval.go b/vendor/cuelang.org/go/internal/core/adt/eval.go
index 17ca96d47..37e8cd936 100644
--- a/vendor/cuelang.org/go/internal/core/adt/eval.go
+++ b/vendor/cuelang.org/go/internal/core/adt/eval.go
@@ -26,10 +26,11 @@ package adt
 
 import (
 	"fmt"
+	"html/template"
+	"strings"
 
 	"cuelang.org/go/cue/ast"
 	"cuelang.org/go/cue/errors"
-	"cuelang.org/go/cue/stats"
 	"cuelang.org/go/cue/token"
 )
 
@@ -42,7 +43,43 @@ import (
 // - Test closedness far more thoroughly.
 //
 
-func (c *OpContext) Stats() *stats.Counts {
+type Stats struct {
+	DisjunctCount int
+	UnifyCount    int
+
+	Freed    int
+	Retained int
+	Reused   int
+	Allocs   int
+}
+
+// Leaks reports the number of nodeContext structs leaked. These are typically
+// benign, as they will just be garbage collected, as long as the pointer from
+// the original nodes has been eliminated or the original nodes are also not
+// referred to. But Leaks may have notable impact on performance, and thus
+// should be avoided.
+func (s *Stats) Leaks() int {
+	return s.Allocs + s.Reused - s.Freed
+}
+
+var stats = template.Must(template.New("stats").Parse(`{{"" -}}
+
+Leaks:  {{.Leaks}}
+Freed:  {{.Freed}}
+Reused: {{.Reused}}
+Allocs: {{.Allocs}}
+Retain: {{.Retained}}
+
+Unifications: {{.UnifyCount}}
+Disjuncts:    {{.DisjunctCount}}`))
+
+func (s *Stats) String() string {
+	buf := &strings.Builder{}
+	_ = stats.Execute(buf, s)
+	return buf.String()
+}
+
+func (c *OpContext) Stats() *Stats {
 	return &c.stats
 }
 
@@ -73,29 +110,10 @@ var incompleteSentinel = &Bottom{
 // error.
 //
 // TODO: return *Vertex
-func (c *OpContext) evaluate(v *Vertex, r Resolver, state VertexStatus) Value {
+func (c *OpContext) evaluate(v *Vertex, state VertexStatus) Value {
 	if v.isUndefined() {
 		// Use node itself to allow for cycle detection.
 		c.Unify(v, state)
-
-		if !v.isDefined() {
-			if v.status == Evaluating {
-				for ; v.Parent != nil && !v.isDefined(); v = v.Parent {
-				}
-				err := c.Newf("cycle with field %v", r)
-				b := &Bottom{Code: CycleError, Err: err}
-				v.SetValue(c, v.status, b)
-				return b
-				// TODO: use this instead, as is usual for incomplete errors,
-				// and also move this block one scope up to also apply to
-				// defined arcs. In both cases, though, doing so results in
-				// some errors to be misclassified as evaluation error.
-				// c.AddBottom(b)
-				// return nil
-			}
-			c.undefinedFieldError(v, IncompleteError)
-			return nil
-		}
 	}
 
 	if n := v.state; n != nil {
@@ -117,7 +135,7 @@ func (c *OpContext) evaluate(v *Vertex, r Resolver, state VertexStatus) Value {
 
 	case nil:
 		if v.state != nil {
-			switch x := v.state.getValidators(Finalized).(type) {
+			switch x := v.state.getValidators().(type) {
 			case Value:
 				return x
 			default:
@@ -126,9 +144,7 @@ func (c *OpContext) evaluate(v *Vertex, r Resolver, state VertexStatus) Value {
 				return &w
 			}
 		}
-		// This may happen if the evaluator is invoked outside of regular
-		// evaluation, such as in dependency analysis.
-		return nil
+		Assertf(false, "no BaseValue: state: %v; requested: %v", v.status, state)
 	}
 
 	if v.status < Finalized && v.state != nil {
@@ -161,24 +177,18 @@ func (c *OpContext) Unify(v *Vertex, state VertexStatus) {
 
 	// Ensure a node will always have a nodeContext after calling Unify if it is
 	// not yet Finalized.
-	n := v.getNodeContext(c, 1)
+	n := v.getNodeContext(c)
 	defer v.freeNode(n)
 
-	// TODO(cycle): verify this happens in all cases when we need it.
-	if n != nil && v.Parent != nil && v.Parent.state != nil {
-		n.depth = v.Parent.state.depth + 1
-	}
-
-	if state <= v.Status() &&
-		state == Partial &&
-		v.isDefined() &&
-		n != nil && n.scalar != nil {
-		return
+	if state <= v.Status() {
+		if v.Status() != Partial && state != Partial {
+			return
+		}
 	}
 
 	switch v.Status() {
 	case Evaluating:
-		n.insertConjuncts(state)
+		n.insertConjuncts()
 		return
 
 	case EvaluatingArcs:
@@ -196,10 +206,6 @@ func (c *OpContext) Unify(v *Vertex, state VertexStatus) {
 			}
 		}
 
-		defer c.PopArc(c.PushArc(v))
-
-		v.UpdateStatus(Evaluating)
-
 		if p := v.Parent; p != nil && p.state != nil && v.Label.IsString() {
 			for _, s := range p.state.node.Structs {
 				if s.Disable {
@@ -209,7 +215,18 @@ func (c *OpContext) Unify(v *Vertex, state VertexStatus) {
 			}
 		}
 
-		c.stats.Unifications++
+		if !n.checkClosed(state) {
+			return
+		}
+
+		defer c.PopArc(c.PushArc(v))
+
+		c.stats.UnifyCount++
+
+		// Clear any remaining error.
+		if err := c.Err(); err != nil {
+			panic("uncaught error")
+		}
 
 		// Set the cache to a cycle error to ensure a cyclic reference will result
 		// in an error if applicable. A cyclic error may be ignored for
@@ -221,56 +238,57 @@ func (c *OpContext) Unify(v *Vertex, state VertexStatus) {
 		// special cycle handling unnecessary.
 		v.BaseValue = cycle
 
-		if c.HasErr() {
-			n.addBottom(c.errs)
-		}
+		v.UpdateStatus(Evaluating)
 
 		n.conjuncts = v.Conjuncts
-		if n.insertConjuncts(state) {
-			n.maybeSetCache()
-			v.UpdateStatus(Partial)
-			return
-		}
+		n.insertConjuncts()
 
 		fallthrough
 
-	case Partial, Conjuncts:
-		// TODO: remove this optimization or make it correct.
-		// No need to do further processing when we have errors and all values
-		// have been considered.
-		// TODO: is checkClosed really still necessary here?
-		if v.status == Conjuncts && (n.hasErr() || !n.checkClosed(state)) {
-			break
-		}
-
+	case Partial:
 		defer c.PopArc(c.PushArc(v))
 
-		n.insertConjuncts(state)
-
 		v.status = Evaluating
 
 		// Use maybeSetCache for cycle breaking
-		for n.maybeSetCache(); n.expandOne(Partial); n.maybeSetCache() {
+		for n.maybeSetCache(); n.expandOne(); n.maybeSetCache() {
 		}
 
 		n.doNotify()
 
 		if !n.done() {
 			switch {
-			case state < Conjuncts:
-				n.node.UpdateStatus(Partial)
-				return
-
-			case state == Conjuncts:
-				if err := n.incompleteErrors(true); err != nil && err.Code < CycleError {
-					n.node.AddErr(c, err)
+			case len(n.disjunctions) > 0 && isCyclePlaceholder(v.BaseValue):
+				// We disallow entering computations of disjunctions with
+				// incomplete data.
+				if state == Finalized {
+					b := c.NewErrf("incomplete cause disjunction")
+					b.Code = IncompleteError
+					n.errs = CombineErrors(nil, n.errs, b)
+					v.SetValue(n.ctx, Finalized, b)
 				} else {
 					n.node.UpdateStatus(Partial)
 				}
 				return
+
+			case state <= AllArcs:
+				n.node.UpdateStatus(Partial)
+				return
 			}
 		}
 
+		if s := v.Status(); state <= s {
+			// We have found a partial result. There may still be errors
+			// down the line which may result from further evaluating this
+			// field, but that will be caught when evaluating this field
+			// for real.
+
+			// This also covers the case where a recursive evaluation triggered
+			// this field to become finalized in the mean time. In that case
+			// we can avoid running another expandDisjuncts.
+			return
+		}
+
 		// Disjunctions should always be finalized. If there are nested
 		// disjunctions the last one should be finalized.
 		disState := state
@@ -286,7 +304,6 @@ func (c *OpContext) Unify(v *Vertex, state VertexStatus) {
 		case 1:
 			x := n.disjuncts[0].result
 			x.state = nil
-			x.cyclicReferences = n.node.cyclicReferences
 			*v = x
 
 		default:
@@ -313,7 +330,6 @@ func (c *OpContext) Unify(v *Vertex, state VertexStatus) {
 				}
 			}
 			v.Arcs = nil
-			v.ChildErrors = nil
 			// v.Structs = nil // TODO: should we keep or discard the Structs?
 			// TODO: how to represent closedness information? Do we need it?
 		}
@@ -326,7 +342,7 @@ func (c *OpContext) Unify(v *Vertex, state VertexStatus) {
 		// We don't do this in postDisjuncts, as it should only be done after
 		// completing all disjunctions.
 		if !n.done() {
-			if err := n.incompleteErrors(true); err != nil {
+			if err := n.incompleteErrors(); err != nil {
 				b, _ := n.node.BaseValue.(*Bottom)
 				if b != err {
 					err = CombineErrors(n.ctx.src, b, err)
@@ -335,46 +351,37 @@ func (c *OpContext) Unify(v *Vertex, state VertexStatus) {
 			}
 		}
 
-		assertStructuralCycle(n)
-
 		if state != Finalized {
 			return
 		}
 
 		if v.BaseValue == nil {
-			v.BaseValue = n.getValidators(Finalized)
+			v.BaseValue = n.getValidators()
 		}
 
 		// Free memory here?
 		v.UpdateStatus(Finalized)
 
+	case AllArcs:
+		if !n.checkClosed(state) {
+			break
+		}
+
+		defer c.PopArc(c.PushArc(v))
+
+		n.completeArcs(state)
+
 	case Finalized:
 	}
 }
 
-// insertConjuncts inserts conjuncts previously not inserted.
-func (n *nodeContext) insertConjuncts(state VertexStatus) bool {
-	// Exit early if we have a concrete value and only need partial results.
-	if state == Partial {
-		for n.conjunctsPos < len(n.conjuncts) {
-			c := n.conjuncts[n.conjunctsPos]
-			n.conjunctsPos++
-			if v, ok := c.Elem().(Value); ok && IsConcrete(v) {
-				n.addValueConjunct(c.Env, v, c.CloseInfo)
-			}
-		}
-		if n.scalar != nil && n.node.isDefined() {
-			return true
-		}
-	}
+// insertConjuncts inserts conjuncts previously uninserted.
+func (n *nodeContext) insertConjuncts() {
 	for len(n.conjuncts) > 0 {
 		nInfos := len(n.node.Structs)
 		p := &n.conjuncts[0]
 		n.conjuncts = n.conjuncts[1:]
-		// Intially request a Partial state to allow cyclic references to
-		// resolve more naturally first. This results in better error messages
-		// and less operations.
-		n.addExprConjunct(*p, Partial)
+		n.addExprConjunct(*p)
 
 		// Record the OptionalTypes for all structs that were inferred by this
 		// Conjunct. This information can be used by algorithms such as trim.
@@ -382,7 +389,6 @@ func (n *nodeContext) insertConjuncts(state VertexStatus) bool {
 			p.CloseInfo.FieldTypes |= n.node.Structs[i].types
 		}
 	}
-	return false
 }
 
 // finalizeDisjuncts: incomplete errors are kept around and not removed early.
@@ -403,7 +409,7 @@ func (n *nodeContext) finalizeDisjuncts() {
 			a[k], a[i] = d, a[k]
 			k++
 		default:
-			if err := d.incompleteErrors(true); err != nil {
+			if err := d.incompleteErrors(); err != nil {
 				n.disjunctErrs = append(n.disjunctErrs, err)
 			}
 		}
@@ -438,7 +444,7 @@ func (n *nodeContext) postDisjunct(state VertexStatus) {
 
 	for {
 		// Use maybeSetCache for cycle breaking
-		for n.maybeSetCache(); n.expandOne(state); n.maybeSetCache() {
+		for n.maybeSetCache(); n.expandOne(); n.maybeSetCache() {
 		}
 
 		if aList, id := n.addLists(); aList != nil {
@@ -452,50 +458,15 @@ func (n *nodeContext) postDisjunct(state VertexStatus) {
 		n.updateNodeType(StructKind, n.aStruct, n.aStructID)
 	}
 
-	if len(n.selfComprehensions) > 0 {
-		// Up to here all comprehensions with sources other than this node will
-		// have had a chance to run. We can now run self-referencing
-		// comprehensions with the restriction that they cannot add new arcs.
-		//
-		// Note: we should only set this in case of self-referential
-		// comprehensions. A comprehension in a parent node may still add
-		// arcs to this node, even if it has reached AllConjunctsDone status,
-		// as long as any evaluation did not rely on its specific set of arcs.
-		// Example:
-		//
-		//	a: {
-		//		b: _env: c: 1
-		//
-		//		// Using dynamic field ("b") prevents the evaluation of the
-		//		// comprehension to be pushed down to env: and instead evaluates
-		//		// it before b is completed. Even though b needs to reach state
-		//		// AllConjunctsDone before evaluating b._env, it is still okay
-		//		// to add arcs to b after this evaluation: only the set of arcs
-		//		// in b._env needs to be frozen after that.
-		//		for for k2, v2 in b._env {
-		//			("b"): env: (k2): v2
-		//		}
-		//	}
-		n.node.LockArcs = true
-
-		n.injectComprehensions(&(n.selfComprehensions), false, state)
-	}
-
-	for n.expandOne(state) {
-	}
-
 	switch err := n.getErr(); {
 	case err != nil:
-		if err.Code < IncompleteError && n.node.arcType == arcVoid {
-			n.node.arcType = arcMember
-		}
 		n.node.BaseValue = err
 		n.errs = nil
 
 	default:
 		if isCyclePlaceholder(n.node.BaseValue) {
 			if !n.done() {
-				n.node.BaseValue = n.incompleteErrors(true)
+				n.node.BaseValue = n.incompleteErrors()
 			} else {
 				n.node.BaseValue = nil
 			}
@@ -512,6 +483,8 @@ func (n *nodeContext) postDisjunct(state VertexStatus) {
 		// }
 
 		// We are no longer evaluating.
+		// n.node.UpdateStatus(Partial)
+		n.node.UpdateStatus(Evaluating)
 
 		// Either set to Conjunction or error.
 		// TODO: verify and simplify the below code to determine whether
@@ -569,7 +542,7 @@ func (n *nodeContext) postDisjunct(state VertexStatus) {
 				}
 			}
 		} else if state == Finalized {
-			n.node.BaseValue = n.getValidators(Finalized)
+			n.node.BaseValue = n.getValidators()
 		}
 
 		if v == nil {
@@ -579,7 +552,7 @@ func (n *nodeContext) postDisjunct(state VertexStatus) {
 		switch {
 		case v.Kind() == ListKind:
 			for _, a := range n.node.Arcs {
-				if a.Label.Typ() == StringLabel && a.IsDefined(ctx) {
+				if a.Label.Typ() == StringLabel {
 					n.addErr(ctx.Newf("list may not have regular fields"))
 					// TODO(errors): add positions for list and arc definitions.
 
@@ -597,73 +570,26 @@ func (n *nodeContext) postDisjunct(state VertexStatus) {
 		}
 	}
 
+	if err := n.getErr(); err != nil {
+		if b, _ := n.node.BaseValue.(*Bottom); b != nil {
+			err = CombineErrors(nil, b, err)
+		}
+		n.node.BaseValue = err
+		// TODO: add return: if evaluation of arcs is important it can be done
+		// later. Logically we're done.
+	}
+
 	n.completeArcs(state)
 }
 
-// incompleteErrors reports all errors from uncompleted conjuncts.
-// If final is true, errors are permanent and reported to parents.
-func (n *nodeContext) incompleteErrors(final bool) *Bottom {
+func (n *nodeContext) incompleteErrors() *Bottom {
 	// collect incomplete errors.
 	var err *Bottom // n.incomplete
 	for _, d := range n.dynamicFields {
 		err = CombineErrors(nil, err, d.err)
 	}
 	for _, c := range n.comprehensions {
-		if c.err == nil {
-			continue
-		}
 		err = CombineErrors(nil, err, c.err)
-
-		// TODO: use this code once possible.
-		//
-		// Add comprehension to ensure incomplete error is inserted. This
-		// ensures that the error is reported in the Vertex where the
-		// comprehension was defined, and not just in the node below. This, in
-		// turn, is necessary to support certain logic, like export, that
-		// expects to be able to detect an "incomplete" error at the first level
-		// where it is necessary.
-		// if c.node.status != Finalized {
-		// 	n := c.node.getNodeContext(n.ctx)
-		// 	n.comprehensions = append(n.comprehensions, c)
-		// } else {
-		// 	n.node.AddErr(n.ctx, err)
-		// }
-		// n := d.node.getNodeContext(ctx)
-		// n.addBottom(err)
-		if final && c.node != nil && c.node.status != Finalized {
-			n := c.node.getNodeContext(n.ctx, 0)
-			n.addBottom(err)
-			c.node = nil
-		}
-	}
-	for _, c := range n.selfComprehensions {
-		if c.err == nil {
-			continue
-		}
-
-		err = CombineErrors(nil, err, c.err)
-
-		// TODO: use this code once possible.
-		//
-		// Add comprehension to ensure incomplete error is inserted. This
-		// ensures that the error is reported in the Vertex where the
-		// comprehension was defined, and not just in the node below. This, in
-		// turn, is necessary to support certain logic, like export, that
-		// expects to be able to detect an "incomplete" error at the first level
-		// where it is necessary.
-		// if c.node.status != Finalized {
-		// 	n := c.node.getNodeContext(n.ctx)
-		// 	n.comprehensions = append(n.comprehensions, c)
-		// } else {
-		// 	n.node.AddErr(n.ctx, err)
-		// }
-		// n := d.node.getNodeContext(ctx)
-		// n.addBottom(err)
-		if c.node != nil && c.node.status != Finalized {
-			n := c.node.getNodeContext(n.ctx, 0)
-			n.addBottom(err)
-			c.node = nil
-		}
 	}
 	for _, x := range n.exprs {
 		err = CombineErrors(nil, err, x.err)
@@ -672,9 +598,6 @@ func (n *nodeContext) incompleteErrors(final bool) *Bottom {
 		// safeguard.
 		err = incompleteSentinel
 	}
-	if err.Code < IncompleteError {
-		n.node.arcType = arcMember
-	}
 	return err
 }
 
@@ -687,7 +610,7 @@ func (n *nodeContext) incompleteErrors(final bool) *Bottom {
 //
 // In practice this should not be a problem: when disjuncts originate
 // from the same disjunct, they will have the same StructInfos, and thus
-// Equal is able to equate them even in the presence of optional field.
+// Equal is able to equate them even in the precense of optional field.
 // In general, combining any limited set of disjuncts will soon reach
 // a fixed point where duplicate elements can be eliminated this way.
 //
@@ -700,7 +623,7 @@ func (n *nodeContext) checkClosed(state VertexStatus) bool {
 	ignore := state != Finalized || n.skipNonMonotonicChecks()
 
 	v := n.node
-	if !v.Label.IsInt() && v.Parent != nil && !ignore && v.isDefined() {
+	if !v.Label.IsInt() && v.Parent != nil && !ignore {
 		ctx := n.ctx
 		// Visit arcs recursively to validate and compute error.
 		if _, err := verifyArc2(ctx, v.Label, v, v.Closed); err != nil {
@@ -720,21 +643,8 @@ func (n *nodeContext) completeArcs(state VertexStatus) {
 		DebugSortArcs(n.ctx, n.node)
 	}
 
-	if n.node.hasAllConjuncts || n.node.Parent == nil {
-		n.node.setParentDone()
-	}
-
-	// At this point, if this arc is of type arcVoid, it means that the value
-	// may still be modified by child arcs. So in this case we must now process
-	// all arcs to be sure we get the correct result.
-	// For other cases we terminate early as this results in considerably
-	// better error messages.
-	if state <= Conjuncts &&
-		// Is allowed to go one step back. See Vertex.UpdateStatus.
-		n.node.status <= state+1 &&
-		n.node.arcType != arcVoid {
-
-		n.node.UpdateStatus(Conjuncts)
+	if state <= AllArcs {
+		n.node.UpdateStatus(AllArcs)
 		return
 	}
 
@@ -743,115 +653,54 @@ func (n *nodeContext) completeArcs(state VertexStatus) {
 	ctx := n.ctx
 
 	if !assertStructuralCycle(n) {
-		k := 0
 		// Visit arcs recursively to validate and compute error.
 		for _, a := range n.node.Arcs {
+			if a.nonMonotonicInsertGen >= a.nonMonotonicLookupGen && a.nonMonotonicLookupGen > 0 {
+				err := ctx.Newf(
+					"cycle: field inserted by if clause that was previously evaluated by another if clause: %s", a.Label)
+				err.AddPosition(n.node)
+				n.node.BaseValue = &Bottom{Err: err}
+			} else if a.nonMonotonicReject {
+				err := ctx.Newf(
+					"cycle: field was added after an if clause evaluated it: %s",
+					a.Label)
+				err.AddPosition(n.node)
+				n.node.BaseValue = &Bottom{Err: err}
+			}
+
 			// Call UpdateStatus here to be absolutely sure the status is set
 			// correctly and that we are not regressing.
 			n.node.UpdateStatus(EvaluatingArcs)
-
-			wasVoid := !a.isDefined()
-
 			ctx.Unify(a, state)
-
-			if !a.isDefined() {
-				continue
+			// Don't set the state to Finalized if the child arcs are not done.
+			if state == Finalized && a.status < Finalized {
+				state = AllArcs
 			}
-
-			// Errors are allowed in let fields. Handle errors and failure to
-			// complete accordingly.
-			if !a.Label.IsLet() {
-				// Don't set the state to Finalized if the child arcs are not done.
-				if state == Finalized && a.status < Finalized {
-					state = Conjuncts
-				}
-
-				if err, _ := a.BaseValue.(*Bottom); err != nil {
-					n.node.AddChildError(err)
-				}
+			if err, _ := a.BaseValue.(*Bottom); err != nil {
+				n.node.AddChildError(err)
 			}
-
-			n.node.Arcs[k] = a
-			k++
-
-			switch {
-			case !wasVoid, !a.Label.IsString():
-			case n.kind&StructKind == 0:
-				n.reportFieldMismatch(pos(a.Value()), nil, a.Label, n.node.Value())
-
-			case n.kind == TopKind:
-				// Theoretically it may be possible that a "void" arc references
-				// this top value where it really should have been a struct. One
-				// way to solve this is to have two passes over the arcs, where
-				// the first pass additionally analyzes whether comprehensions
-				// will yield values and "un-voids" an arc ahead of the rest.
-				//
-				// At this moment, though, I fail to see a possibility to create
-				// faulty CUE using this mechanism, though. At most error
-				// messages are a bit unintuitive. This may change once we have
-				// functionality to reflect on types.
-				if _, ok := n.node.BaseValue.(*Bottom); !ok {
-					n.node.BaseValue = &StructMarker{}
-					n.kind = StructKind
-				}
-			}
-		}
-		n.node.Arcs = n.node.Arcs[:k]
-
-		for _, c := range n.postChecks {
-			f := ctx.PushState(c.env, c.expr.Source())
-
-			// TODO(errors): make Validate return bottom and generate
-			// optimized conflict message. Also track and inject IDs
-			// to determine origin location.s
-			v := ctx.evalState(c.expr, Finalized)
-			v, _ = ctx.getDefault(v)
-			v = Unwrap(v)
-
-			switch _, isError := v.(*Bottom); {
-			case isError == c.expectError:
-			default:
-				n.node.AddErr(ctx, &Bottom{
-					Src:  c.expr.Source(),
-					Code: CycleError,
-					Err: ctx.NewPosf(pos(c.expr),
-						"circular dependency in evaluation of conditionals: %v changed after evaluation",
-						ctx.Str(c.expr)),
-				})
-			}
-
-			ctx.PopState(f)
-		}
-	}
-
-	if err := n.getErr(); err != nil {
-		n.errs = nil
-		if b, _ := n.node.BaseValue.(*Bottom); b != nil {
-			err = CombineErrors(nil, b, err)
 		}
-		n.node.BaseValue = err
 	}
 
-	b, hasErr := n.node.BaseValue.(*Bottom)
-	if !hasErr && b != cycle {
-		n.checkClosed(state)
-	}
+	n.node.UpdateStatus(state)
+}
 
-	// Strip struct literals that were not initialized and are not part
-	// of the output.
-	//
-	// TODO(perf): we could keep track if any such structs exist and only
-	// do this removal if there is a change of shrinking the list.
-	k := 0
-	for _, s := range n.node.Structs {
-		if s.initialized {
-			n.node.Structs[k] = s
-			k++
-		}
+func assertStructuralCycle(n *nodeContext) bool {
+	if cyclic := n.hasCycle && !n.hasNonCycle; cyclic {
+		n.node.BaseValue = CombineErrors(nil,
+			n.node.Value(),
+			&Bottom{
+				Code:  StructuralCycleError,
+				Err:   n.ctx.Newf("structural cycle"),
+				Value: n.node.Value(),
+				// TODO: probably, this should have the referenced arc.
+			})
+		// Don't process Arcs. This is mostly to ensure that no Arcs with
+		// an Unprocessed status remain in the output.
+		n.node.Arcs = nil
+		return true
 	}
-	n.node.Structs = n.node.Structs[:k]
-
-	n.node.UpdateStatus(Finalized)
+	return false
 }
 
 // TODO: this is now a sentinel. Use a user-facing error that traces where
@@ -915,6 +764,9 @@ type nodeContext struct {
 	ctx  *OpContext
 	node *Vertex
 
+	// usedArcs is a list of arcs that were looked up during non-monotonic operations, but do not exist yet.
+	usedArcs []*Vertex
+
 	// TODO: (this is CL is first step)
 	// filter *Vertex a subset of composite with concrete fields for
 	// bloom-like filtering of disjuncts. We should first verify, however,
@@ -942,29 +794,21 @@ type nodeContext struct {
 	lowerBound *BoundValue // > or >=
 	upperBound *BoundValue // < or <=
 	checks     []Validator // BuiltinValidator, other bound values.
-	postChecks []envCheck  // Check non-monotic constraints, among other things.
 	errs       *Bottom
 
 	// Conjuncts holds a reference to the Vertex Arcs that still need
 	// processing. It does NOT need to be copied.
-	conjuncts       []Conjunct
-	cyclicConjuncts []cyclicConjunct
-
-	// conjunctsPos is an index into conjuncts indicating the next conjunct
-	// to process. This is used to avoids processing a conjunct twice in some
-	// cases where there is an evaluation cycle.
-	conjunctsPos int
+	conjuncts []Conjunct
 
 	// notify is used to communicate errors in cyclic dependencies.
 	// TODO: also use this to communicate increasingly more concrete values.
 	notify []*Vertex
 
 	// Struct information
-	dynamicFields      []envDynamic
-	comprehensions     []envYield
-	selfComprehensions []envYield // comprehensions iterating over own struct.
-	aStruct            Expr
-	aStructID          CloseInfo
+	dynamicFields  []envDynamic
+	comprehensions []envYield
+	aStruct        Expr
+	aStructID      CloseInfo
 
 	// Expression conjuncts
 	lists  []envList
@@ -974,7 +818,6 @@ type nodeContext struct {
 	hasTop      bool
 	hasCycle    bool // has conjunct with structural cycle
 	hasNonCycle bool // has conjunct without structural cycle
-	depth       int32
 
 	// Disjunction handling
 	disjunctions []envDisjunct
@@ -991,13 +834,6 @@ type nodeContext struct {
 	disjunctErrs []*Bottom
 }
 
-// Logf substitutes args in format. Arguments of type Feature, Value, and Expr
-// are printed in human-friendly formats. The printed string is prefixed and
-// indented with the path associated with the current nodeContext.
-func (n *nodeContext) Logf(format string, args ...interface{}) {
-	n.ctx.Logf(n.node, format, args...)
-}
-
 type defaultInfo struct {
 	// parentMode indicates whether this values was used as a default value,
 	// based on the parent mode.
@@ -1010,7 +846,7 @@ type defaultInfo struct {
 }
 
 func (n *nodeContext) addNotify(v *Vertex) {
-	if v != nil && !n.node.hasAllConjuncts {
+	if v != nil {
 		n.notify = append(n.notify, v)
 	}
 }
@@ -1038,16 +874,13 @@ func (n *nodeContext) clone() *nodeContext {
 	d.hasTop = n.hasTop
 	d.hasCycle = n.hasCycle
 	d.hasNonCycle = n.hasNonCycle
-	d.depth = n.depth
 
 	// d.arcMap = append(d.arcMap, n.arcMap...) // XXX add?
-	d.cyclicConjuncts = append(d.cyclicConjuncts, n.cyclicConjuncts...)
+	// d.usedArcs = append(d.usedArcs, n.usedArcs...) // XXX: add?
 	d.notify = append(d.notify, n.notify...)
 	d.checks = append(d.checks, n.checks...)
-	d.postChecks = append(d.postChecks, n.postChecks...)
 	d.dynamicFields = append(d.dynamicFields, n.dynamicFields...)
 	d.comprehensions = append(d.comprehensions, n.comprehensions...)
-	d.selfComprehensions = append(d.selfComprehensions, n.selfComprehensions...)
 	d.lists = append(d.lists, n.lists...)
 	d.vLists = append(d.vLists, n.vLists...)
 	d.exprs = append(d.exprs, n.exprs...)
@@ -1064,25 +897,23 @@ func (c *OpContext) newNodeContext(node *Vertex) *nodeContext {
 		c.freeListNode = n.nextFree
 
 		*n = nodeContext{
-			ctx:                c,
-			node:               node,
-			kind:               TopKind,
-			arcMap:             n.arcMap[:0],
-			cyclicConjuncts:    n.cyclicConjuncts[:0],
-			notify:             n.notify[:0],
-			checks:             n.checks[:0],
-			postChecks:         n.postChecks[:0],
-			dynamicFields:      n.dynamicFields[:0],
-			comprehensions:     n.comprehensions[:0],
-			selfComprehensions: n.selfComprehensions[:0],
-			lists:              n.lists[:0],
-			vLists:             n.vLists[:0],
-			exprs:              n.exprs[:0],
-			disjunctions:       n.disjunctions[:0],
-			usedDefault:        n.usedDefault[:0],
-			disjunctErrs:       n.disjunctErrs[:0],
-			disjuncts:          n.disjuncts[:0],
-			buffer:             n.buffer[:0],
+			ctx:            c,
+			node:           node,
+			kind:           TopKind,
+			usedArcs:       n.usedArcs[:0],
+			arcMap:         n.arcMap[:0],
+			notify:         n.notify[:0],
+			checks:         n.checks[:0],
+			dynamicFields:  n.dynamicFields[:0],
+			comprehensions: n.comprehensions[:0],
+			lists:          n.lists[:0],
+			vLists:         n.vLists[:0],
+			exprs:          n.exprs[:0],
+			disjunctions:   n.disjunctions[:0],
+			usedDefault:    n.usedDefault[:0],
+			disjunctErrs:   n.disjunctErrs[:0],
+			disjuncts:      n.disjuncts[:0],
+			buffer:         n.buffer[:0],
 		}
 
 		return n
@@ -1096,7 +927,7 @@ func (c *OpContext) newNodeContext(node *Vertex) *nodeContext {
 	}
 }
 
-func (v *Vertex) getNodeContext(c *OpContext, ref int) *nodeContext {
+func (v *Vertex) getNodeContext(c *OpContext) *nodeContext {
 	if v.state == nil {
 		if v.status == Finalized {
 			return nil
@@ -1105,7 +936,7 @@ func (v *Vertex) getNodeContext(c *OpContext, ref int) *nodeContext {
 	} else if v.state.node != v {
 		panic("getNodeContext: nodeContext out of sync")
 	}
-	v.state.refCount += ref
+	v.state.refCount++
 	return v.state
 }
 
@@ -1265,9 +1096,7 @@ func (n *nodeContext) finalDone() bool {
 			return false
 		}
 	}
-	return len(n.dynamicFields) == 0 &&
-		len(n.comprehensions) == 0 &&
-		len(n.selfComprehensions) == 0
+	return len(n.dynamicFields) == 0 && len(n.comprehensions) == 0
 }
 
 // hasErr is used to determine if an evaluation path, for instance a single
@@ -1288,7 +1117,7 @@ func (n *nodeContext) getErr() *Bottom {
 }
 
 // getValidators sets the vertex' Value in case there was no concrete value.
-func (n *nodeContext) getValidators(state VertexStatus) BaseValue {
+func (n *nodeContext) getValidators() BaseValue {
 	ctx := n.ctx
 
 	a := []Value{}
@@ -1331,12 +1160,10 @@ func (n *nodeContext) getValidators(state VertexStatus) BaseValue {
 	switch len(a) {
 	case 0:
 		// Src is the combined input.
-		if state >= Conjuncts || n.kind&^CompositKind == 0 {
-			v = &BasicType{K: n.kind}
-		}
+		v = &BasicType{K: n.kind}
 
 	case 1:
-		v = a[0]
+		v = a[0].(Value) // remove cast
 
 	default:
 		v = &Conjunction{Values: a}
@@ -1347,10 +1174,10 @@ func (n *nodeContext) getValidators(state VertexStatus) BaseValue {
 
 // TODO: this function can probably go as this is now handled in the nodeContext.
 func (n *nodeContext) maybeSetCache() {
-	// Set BaseValue to scalar, but only if it was not set before. Most notably,
-	// errors should not be discarded.
-	_, isErr := n.node.BaseValue.(*Bottom)
-	if n.scalar != nil && (!isErr || isCyclePlaceholder(n.node.BaseValue)) {
+	if n.node.Status() > Partial { // n.node.BaseValue != nil
+		return
+	}
+	if n.scalar != nil {
 		n.node.BaseValue = n.scalar
 	}
 	// NOTE: this is now handled by associating the nodeContext
@@ -1377,15 +1204,6 @@ type envList struct {
 	n       int64 // recorded length after evaluator
 	elipsis *Ellipsis
 	id      CloseInfo
-	ignore  bool // has a self-referencing comprehension and is postponed
-	self    bool // was added as a postponed self-referencing comprehension
-	index   int
-}
-
-type envCheck struct {
-	env         *Environment
-	expr        Expr
-	expectError bool
 }
 
 func (n *nodeContext) addBottom(b *Bottom) {
@@ -1404,7 +1222,7 @@ func (n *nodeContext) addErr(err errors.Error) {
 // addExprConjuncts will attempt to evaluate an Expr and insert the value
 // into the nodeContext if successful or queue it for later evaluation if it is
 // incomplete or is not value.
-func (n *nodeContext) addExprConjunct(v Conjunct, state VertexStatus) {
+func (n *nodeContext) addExprConjunct(v Conjunct) {
 	env := v.Env
 	id := v.CloseInfo
 
@@ -1421,11 +1239,10 @@ func (n *nodeContext) addExprConjunct(v Conjunct, state VertexStatus) {
 
 	case *BinaryExpr:
 		if x.Op == AndOp {
-			n.addExprConjunct(MakeConjunct(env, x.X, id), state)
-			n.addExprConjunct(MakeConjunct(env, x.Y, id), state)
-			return
+			n.addExprConjunct(MakeConjunct(env, x.X, id))
+			n.addExprConjunct(MakeConjunct(env, x.Y, id))
 		} else {
-			n.evalExpr(v, state)
+			n.evalExpr(v)
 		}
 
 	case *StructLit:
@@ -1436,42 +1253,49 @@ func (n *nodeContext) addExprConjunct(v Conjunct, state VertexStatus) {
 			Up:     env,
 			Vertex: n.node,
 		}
+		if env != nil {
+			childEnv.Cyclic = env.Cyclic
+			childEnv.Deref = env.Deref
+		}
 		n.lists = append(n.lists, envList{env: childEnv, list: x, id: id})
 
 	case *DisjunctionExpr:
 		n.addDisjunction(env, x, id)
 
-	case *Comprehension:
-		// always a partial comprehension.
-		n.insertComprehension(env, x, id)
-		return
-
 	default:
 		// Must be Resolver or Evaluator.
-		n.evalExpr(v, state)
+		n.evalExpr(v)
 	}
-	n.ctx.stats.Conjuncts++
 }
 
 // evalExpr is only called by addExprConjunct. If an error occurs, it records
 // the error in n and returns nil.
-func (n *nodeContext) evalExpr(v Conjunct, state VertexStatus) {
+func (n *nodeContext) evalExpr(v Conjunct) {
 	// Require an Environment.
 	ctx := n.ctx
 
 	closeID := v.CloseInfo
 
+	// TODO: see if we can do without these counters.
+	for _, d := range v.Env.Deref {
+		d.EvalCount++
+	}
+	for _, d := range v.Env.Cycles {
+		d.SelfCount++
+	}
+	defer func() {
+		for _, d := range v.Env.Deref {
+			d.EvalCount--
+		}
+		for _, d := range v.Env.Cycles {
+			d.SelfCount++
+		}
+	}()
+
 	switch x := v.Expr().(type) {
 	case Resolver:
-		// We elevate a field evaluated to the Conjuncts state to Finalized
-		// later. For now we allow partial evaluation so that we can break
-		// cycles and postpone incomplete evaluations until more information is
-		// available down the line.
-		if state == Finalized {
-			state = Conjuncts
-		}
-		arc, err := ctx.resolveState(v, x, state)
-		if err != nil && (!err.IsIncomplete() || err.Permanent) {
+		arc, err := ctx.Resolve(v.Env, x)
+		if err != nil && !err.IsIncomplete() {
 			n.addBottom(err)
 			break
 		}
@@ -1480,36 +1304,13 @@ func (n *nodeContext) evalExpr(v Conjunct, state VertexStatus) {
 			break
 		}
 
-		// We complete the evaluation. Some optimizations will only work when an
-		// arc is already finalized. So this ensures that such optimizations get
-		// triggered more often.
-		//
-		// NOTE(let finalization): aside from being an optimization, this also
-		// ensures that let arcs that are not contained as fields of arcs, but
-		// rather are held in the cash, are finalized. This, in turn, is
-		// necessary to trigger the notification mechanism, where appropriate.
-		//
-		// A node should not Finalize itself as it may erase the state object
-		// which is still assumed to be present down the line
-		// (see https://cuelang.org/issues/2171).
-		if arc.status == Conjuncts && arc != n.node && arc.hasAllConjuncts {
-			arc.Finalize(ctx)
-		}
-
-		ci, skip := n.markCycle(arc, v.Env, x, v.CloseInfo)
-		if skip {
-			return
-		}
-		v.CloseInfo = ci
-
 		n.addVertexConjuncts(v, arc, false)
 
 	case Evaluator:
 		// Interpolation, UnaryExpr, BinaryExpr, CallExpr
 		// Could be unify?
-		val := ctx.evaluateRec(v, Partial)
-		if b, ok := val.(*Bottom); ok &&
-			b.IsIncomplete() {
+		val := ctx.evaluateRec(v.Env, v.Expr(), Partial)
+		if b, ok := val.(*Bottom); ok && b.IsIncomplete() {
 			n.exprs = append(n.exprs, envExpr{v, b})
 			break
 		}
@@ -1521,7 +1322,7 @@ func (n *nodeContext) evalExpr(v Conjunct, state VertexStatus) {
 			if ok && b.IsIncomplete() && len(v.Conjuncts) > 0 {
 				for _, c := range v.Conjuncts {
 					c.CloseInfo = closeID
-					n.addExprConjunct(c, state)
+					n.addExprConjunct(c)
 				}
 				break
 			}
@@ -1567,11 +1368,7 @@ func (n *nodeContext) addVertexConjuncts(c Conjunct, arc *Vertex, inline bool) {
 	// (pointer can probably be shared). Aside from being more performant,
 	// this is probably the best way to guarantee that conjunctions are
 	// linear in this case.
-
-	ckey := closeInfo
-	ckey.Refs = nil
-	ckey.Inline = false
-	key := arcKey{arc, ckey}
+	key := arcKey{arc, closeInfo}
 	for _, k := range n.arcMap {
 		if key == k {
 			return
@@ -1579,6 +1376,14 @@ func (n *nodeContext) addVertexConjuncts(c Conjunct, arc *Vertex, inline bool) {
 	}
 	n.arcMap = append(n.arcMap, key)
 
+	env := c.Env
+	// Pass detection of structural cycles from parent to children.
+	cyclic := false
+	if env != nil {
+		// If a reference is in a tainted set, so is the value it refers to.
+		cyclic = env.Cyclic
+	}
+
 	status := arc.Status()
 
 	switch status {
@@ -1598,8 +1403,31 @@ func (n *nodeContext) addVertexConjuncts(c Conjunct, arc *Vertex, inline bool) {
 		}
 
 	case EvaluatingArcs:
-		// There is a structural cycle, but values may be processed nonetheless
-		// if there is a non-cyclic conjunct. See cycle.go.
+		// Structural cycle detected. Continue evaluation as usual, but
+		// keep track of whether any other conjuncts without structural
+		// cycles are added. If not, evaluation of child arcs will end
+		// with this node.
+
+		// For the purpose of determining whether at least one non-cyclic
+		// conjuncts exists, we consider all conjuncts of a cyclic conjuncts
+		// also cyclic.
+
+		cyclic = true
+		n.hasCycle = true
+
+		// As the EvaluatingArcs mechanism bypasses the self-reference
+		// mechanism, we need to separately keep track of it here.
+		// If this (originally) is a self-reference node, adding them
+		// will result in recursively adding the same reference. For this
+		// we also mark the node as evaluating.
+		if arc.SelfCount > 0 {
+			return
+		}
+
+		// This count is added for values that are directly added below.
+		// The count is handled separately for delayed values.
+		arc.SelfCount++
+		defer func() { arc.SelfCount-- }()
 	}
 
 	// Performance: the following if check filters cases that are not strictly
@@ -1623,21 +1451,22 @@ func (n *nodeContext) addVertexConjuncts(c Conjunct, arc *Vertex, inline bool) {
 		n.ctx.Unify(arc, Partial)
 	}
 
-	// Don't add conjuncts if a node is referring to itself.
-	if n.node == arc {
-		return
-	}
-
-	if arc.state != nil {
-		arc.state.addNotify(n.node)
-	}
-
 	for _, c := range arc.Conjuncts {
+		var a []*Vertex
+		if env != nil {
+			a = env.Deref
+		}
+		if inline {
+			c = updateCyclic(c, cyclic, nil, nil)
+		} else {
+			c = updateCyclic(c, cyclic, arc, a)
+		}
+
 		// Note that we are resetting the tree here. We hereby assume that
 		// closedness conflicts resulting from unifying the referenced arc were
 		// already caught there and that we can ignore further errors here.
 		c.CloseInfo = closeInfo
-		n.addExprConjunct(c, Partial)
+		n.addExprConjunct(c)
 	}
 }
 
@@ -1663,8 +1492,47 @@ func isDef(x Expr) bool {
 	return false
 }
 
+// updateCyclicStatus looks for proof of non-cyclic conjuncts to override
+// a structural cycle.
+func (n *nodeContext) updateCyclicStatus(env *Environment) {
+	if env == nil || !env.Cyclic {
+		n.hasNonCycle = true
+	}
+}
+
+func updateCyclic(c Conjunct, cyclic bool, deref *Vertex, a []*Vertex) Conjunct {
+	env := c.Env
+	switch {
+	case env == nil:
+		if !cyclic && deref == nil {
+			return c
+		}
+		env = &Environment{Cyclic: cyclic}
+	case deref == nil && env.Cyclic == cyclic && len(a) == 0:
+		return c
+	default:
+		// The conjunct may still be in use in other fields, so we should
+		// make a new copy to mark Cyclic only for this case.
+		e := *env
+		e.Cyclic = e.Cyclic || cyclic
+		env = &e
+	}
+	if deref != nil || len(a) > 0 {
+		cp := make([]*Vertex, 0, len(a)+1)
+		cp = append(cp, a...)
+		if deref != nil {
+			cp = append(cp, deref)
+		}
+		env.Deref = cp
+	}
+	if deref != nil {
+		env.Cycles = append(env.Cycles, deref)
+	}
+	return MakeConjunct(env, c.Elem(), c.CloseInfo)
+}
+
 func (n *nodeContext) addValueConjunct(env *Environment, v Value, id CloseInfo) {
-	n.updateCyclicStatus(id)
+	n.updateCyclicStatus(env)
 
 	ctx := n.ctx
 
@@ -1673,10 +1541,13 @@ func (n *nodeContext) addValueConjunct(env *Environment, v Value, id CloseInfo)
 			n.aStruct = x
 			n.aStructID = id
 			if m.NeedClose {
+				id = id.SpawnRef(x, IsDef(x), x)
 				id.IsClosed = true
 			}
 		}
 
+		cyclic := env != nil && env.Cyclic
+
 		if !x.IsData() {
 			// TODO: this really shouldn't happen anymore.
 			if isComplexStruct(ctx, x) {
@@ -1686,8 +1557,9 @@ func (n *nodeContext) addValueConjunct(env *Environment, v Value, id CloseInfo)
 			}
 
 			for _, c := range x.Conjuncts {
+				c = updateCyclic(c, cyclic, nil, nil)
 				c.CloseInfo = id
-				n.addExprConjunct(c, Partial) // TODO: Pass from eval
+				n.addExprConjunct(c) // TODO: Pass from eval
 			}
 			return
 		}
@@ -1718,11 +1590,9 @@ func (n *nodeContext) addValueConjunct(env *Environment, v Value, id CloseInfo)
 		n.node.Structs = append(n.node.Structs, x.Structs...)
 
 		for _, a := range x.Arcs {
-			if !a.IsDefined(ctx) {
-				continue
-			}
 			// TODO(errors): report error when this is a regular field.
 			c := MakeConjunct(nil, a, id)
+			c = updateCyclic(c, cyclic, nil, nil)
 			n.insertField(a.Label, c)
 			s.MarkField(a.Label)
 		}
@@ -1875,25 +1745,37 @@ func valueError(v Value) *ValueError {
 // addStruct collates the declarations of a struct.
 //
 // addStruct fulfills two additional pivotal functions:
-//  1. Implement vertex unification (this happens through De Bruijn indices
-//     combined with proper set up of Environments).
-//  2. Implied closedness for definitions.
+//   1) Implement vertex unification (this happens through De Bruijn indices
+//      combined with proper set up of Environments).
+//   2) Implied closedness for definitions.
+//
 func (n *nodeContext) addStruct(
 	env *Environment,
 	s *StructLit,
 	closeInfo CloseInfo) {
 
-	n.updateCyclicStatus(closeInfo)
+	n.updateCyclicStatus(env) // to handle empty structs.
 
 	// NOTE: This is a crucial point in the code:
-	// Unification dereferencing happens here. The child nodes are set to
+	// Unification derferencing happens here. The child nodes are set to
 	// an Environment linked to the current node. Together with the De Bruijn
 	// indices, this determines to which Vertex a reference resolves.
 
+	// TODO(perf): consider using environment cache:
+	// var childEnv *Environment
+	// for _, s := range n.nodeCache.sub {
+	// 	if s.Up == env {
+	// 		childEnv = s
+	// 	}
+	// }
 	childEnv := &Environment{
 		Up:     env,
 		Vertex: n.node,
 	}
+	if env != nil {
+		childEnv.Cyclic = env.Cyclic
+		childEnv.Deref = env.Deref
+	}
 
 	s.Init()
 
@@ -1907,7 +1789,7 @@ func (n *nodeContext) addStruct(
 
 	for _, d := range s.Decls {
 		switch x := d.(type) {
-		case *Field, *LetField:
+		case *Field:
 			// handle in next iteration.
 
 		case *DynamicField:
@@ -1926,10 +1808,10 @@ func (n *nodeContext) addStruct(
 			id := closeInfo.SpawnEmbed(x)
 
 			// push and opo embedding type.
-			n.addExprConjunct(MakeConjunct(childEnv, x, id), Partial)
+			n.addExprConjunct(MakeConjunct(childEnv, x, id))
 
 		case *OptionalField, *BulkOptionalField, *Ellipsis:
-			// Nothing to do here. Note that the presence of these fields do not
+			// Nothing to do here. Note that the precense of these fields do not
 			// excluded embedded scalars: only when they match actual fields
 			// does it exclude those.
 
@@ -1953,12 +1835,6 @@ func (n *nodeContext) addStruct(
 				n.aStructID = closeInfo
 			}
 			n.insertField(x.Label, MakeConjunct(childEnv, x, closeInfo))
-
-		case *LetField:
-			arc := n.insertField(x.Label, MakeConjunct(childEnv, x, closeInfo))
-			if x.IsMulti {
-				arc.MultiLet = x.IsMulti
-			}
 		}
 	}
 }
@@ -1976,22 +1852,32 @@ func (n *nodeContext) addStruct(
 // disjunctions.
 func (n *nodeContext) insertField(f Feature, x Conjunct) *Vertex {
 	ctx := n.ctx
-	arc, isNew := n.node.GetArc(ctx, f, arcMember)
-	if f.IsLet() && !isNew {
-		arc.MultiLet = true
-		return arc
-	}
-	if arc.hasConjunct(x) {
-		return arc
-	}
+	arc, _ := n.node.GetArc(ctx, f)
+
+	arc.addConjunct(x)
 
 	switch {
 	case arc.state != nil:
-		arc.state.addConjunctDynamic(x)
+		s := arc.state
+		switch {
+		case arc.Status() <= AllArcs:
+			// This may happen when a struct has multiple comprehensions, where
+			// the insertion of one of which depends on the outcome of another.
 
-	case arc.Status() == 0:
-		arc.addConjunctUnchecked(x)
+			// TODO: to something more principled by allowing values to
+			// monotonically increase.
+			arc.status = Partial
+			arc.BaseValue = nil
+			s.disjuncts = s.disjuncts[:0]
+			s.disjunctErrs = s.disjunctErrs[:0]
+
+			fallthrough
 
+		default:
+			arc.state.addExprConjunct(x)
+		}
+
+	case arc.Status() == 0:
 	default:
 		n.addBottom(&Bottom{
 			Code: IncompleteError,
@@ -2016,7 +1902,7 @@ func (n *nodeContext) insertField(f Feature, x Conjunct) *Vertex {
 // This seems to be too complicated and lead to iffy edge cases.
 // TODO(errors): detect when a field is added to a struct that is already used
 // in a for clause.
-func (n *nodeContext) expandOne(state VertexStatus) (done bool) {
+func (n *nodeContext) expandOne() (done bool) {
 	// Don't expand incomplete expressions if we detected a cycle.
 	if n.done() || (n.hasCycle && !n.hasNonCycle) {
 		return false
@@ -2028,7 +1914,7 @@ func (n *nodeContext) expandOne(state VertexStatus) (done bool) {
 		return true
 	}
 
-	if progress = n.injectComprehensions(&(n.comprehensions), true, state); progress {
+	if progress = n.injectComprehensions(&(n.comprehensions)); progress {
 		return true
 	}
 
@@ -2039,7 +1925,7 @@ func (n *nodeContext) expandOne(state VertexStatus) (done bool) {
 	exprs := n.exprs
 	n.exprs = n.exprs[:0]
 	for _, x := range exprs {
-		n.addExprConjunct(x.c, state)
+		n.addExprConjunct(x.c)
 
 		// collect and and or
 	}
@@ -2060,13 +1946,8 @@ func (n *nodeContext) injectDynamic() (progress bool) {
 	a := n.dynamicFields
 	for _, d := range n.dynamicFields {
 		var f Feature
-		x := d.field.Key
-		// Push state to capture and remove errors.
-		s := ctx.PushState(d.env, x.Source())
-		v := ctx.evalState(x, Finalized)
-		b := ctx.PopState(s)
-
-		if b != nil && b.IsIncomplete() {
+		v, complete := ctx.Evaluate(d.env, d.field.Key)
+		if !complete {
 			d.err, _ = v.(*Bottom)
 			a[k] = d
 			k++
@@ -2098,8 +1979,8 @@ func (n *nodeContext) injectDynamic() (progress bool) {
 // or struct fields and not both.
 //
 // addLists should be run after the fixpoint expansion:
-//   - it enforces that comprehensions may not refer to the list itself
-//   - there may be no other fields within the list.
+//    - it enforces that comprehensions may not refer to the list itself
+//    - there may be no other fields within the list.
 //
 // TODO(embeddedScalars): for embedded scalars, there should be another pass
 // of evaluation expressions after expanding lists.
@@ -2120,8 +2001,6 @@ func (n *nodeContext) addLists() (oneOfTheLists Expr, anID CloseInfo) {
 	c := n.ctx
 
 	for _, l := range n.vLists {
-		// XXX: set hasNonCycle if appropriate.
-
 		oneOfTheLists = l
 
 		elems := l.Elems()
@@ -2150,7 +2029,8 @@ func (n *nodeContext) addLists() (oneOfTheLists Expr, anID CloseInfo) {
 
 		for _, a := range elems {
 			if a.Conjuncts == nil {
-				n.insertField(a.Label, MakeRootConjunct(nil, a))
+				x := a.BaseValue.(Value)
+				n.insertField(a.Label, MakeConjunct(nil, x, CloseInfo{}))
 				continue
 			}
 			for _, c := range a.Conjuncts {
@@ -2160,22 +2040,15 @@ func (n *nodeContext) addLists() (oneOfTheLists Expr, anID CloseInfo) {
 	}
 
 outer:
-	// updateCyclicStatus may grow the list of values, so we cannot use range.
-	for i := 0; i < len(n.lists); i++ {
-		l := n.lists[i]
-
-		n.updateCyclicStatus(l.id)
-
-		if l.self {
-			n.node.LockArcs = true
-		}
+	for i, l := range n.lists {
+		n.updateCyclicStatus(l.env.Up)
 
 		index := int64(0)
 		hasComprehension := false
 		for j, elem := range l.list.Elems {
 			switch x := elem.(type) {
 			case *Comprehension:
-				err := c.yield(nil, l.env, x, Finalized, func(e *Environment) {
+				err := c.Yield(l.env, x, func(e *Environment) {
 					label, err := MakeLabel(x.Source(), index, IntLabel)
 					n.addErr(err)
 					index++
@@ -2184,16 +2057,7 @@ outer:
 				})
 				hasComprehension = true
 				if err != nil {
-					if err.ForCycle && !l.self {
-						// The list has a comprehension that refers to the list
-						// itself. This means we should postpone evalauting this
-						// list until all other lists have been evaluated.
-						n.lists[i].ignore = true
-						l.self = true
-						n.lists = append(n.lists, l)
-					} else {
-						n.addBottom(err)
-					}
+					n.addBottom(err)
 					continue outer
 				}
 
@@ -2257,7 +2121,7 @@ outer:
 	}
 
 	for _, l := range n.lists {
-		if l.elipsis == nil || l.ignore {
+		if l.elipsis == nil {
 			continue
 		}
 
@@ -2277,7 +2141,7 @@ outer:
 	sources := []ast.Expr{}
 	// Add conjuncts for additional items.
 	for _, l := range n.lists {
-		if l.elipsis == nil || l.ignore {
+		if l.elipsis == nil {
 			continue
 		}
 		if src, _ := l.elipsis.Source().(ast.Expr); src != nil {
diff --git a/vendor/cuelang.org/go/internal/core/adt/expr.go b/vendor/cuelang.org/go/internal/core/adt/expr.go
index cfe6fb19d..31aeda234 100644
--- a/vendor/cuelang.org/go/internal/core/adt/expr.go
+++ b/vendor/cuelang.org/go/internal/core/adt/expr.go
@@ -72,18 +72,17 @@ func (x *StructLit) HasOptional() bool {
 
 func (x *StructLit) Source() ast.Node { return x.Src }
 
-func (x *StructLit) evaluate(c *OpContext, state VertexStatus) Value {
+func (x *StructLit) evaluate(c *OpContext) Value {
 	e := c.Env(0)
 	v := &Vertex{
 		Parent:    e.Vertex,
-		IsDynamic: true,
-		Conjuncts: []Conjunct{{e, x, c.ci}},
+		Conjuncts: []Conjunct{{e, x, CloseInfo{}}},
 	}
 	// evaluate may not finalize a field, as the resulting value may be
 	// used in a context where more conjuncts are added. It may also lead
 	// to disjuncts being in a partially expanded state, leading to
 	// misaligned nodeContexts.
-	c.Unify(v, Conjuncts)
+	c.Unify(v, AllArcs)
 	return v
 }
 
@@ -113,12 +112,6 @@ func (o *StructLit) Init() {
 			o.Fields[p].Optional = append(o.Fields[p].Optional, x)
 			o.types |= HasField
 
-		case *LetField:
-			if o.fieldIndex(x.Label) >= 0 {
-				panic("duplicate let identifier")
-			}
-			o.Fields = append(o.Fields, FieldInfo{Label: x.Label})
-
 		case *DynamicField:
 			o.Dynamic = append(o.Dynamic, x)
 			o.types |= HasDynamic
@@ -172,7 +165,7 @@ func (o *StructLit) OptionalTypes() OptionalType {
 	return o.types
 }
 
-func (o *StructLit) IsOptionalField(label Feature) bool {
+func (o *StructLit) IsOptional(label Feature) bool {
 	for _, f := range o.Fields {
 		if f.Label == label && len(f.Optional) > 0 {
 			return true
@@ -189,13 +182,14 @@ func (o *StructLit) IsOptionalField(label Feature) bool {
 // Field represents a field with a fixed label. It can be a regular field,
 // definition or hidden field.
 //
-//	foo: bar
-//	#foo: bar
-//	_foo: bar
+//   foo: bar
+//   #foo: bar
+//   _foo: bar
 //
 // Legacy:
 //
-//	Foo :: bar
+//   Foo :: bar
+//
 type Field struct {
 	Src *ast.Field
 
@@ -212,7 +206,8 @@ func (x *Field) Source() ast.Node {
 
 // An OptionalField represents an optional regular field.
 //
-//	foo?: expr
+//   foo?: expr
+//
 type OptionalField struct {
 	Src   *ast.Field
 	Label Feature
@@ -226,29 +221,10 @@ func (x *OptionalField) Source() ast.Node {
 	return x.Src
 }
 
-// A LetField represents a field that is only visible in the local scope.
-//
-//	let X = expr
-type LetField struct {
-	Src   *ast.LetClause
-	Label Feature
-	// IsMulti is true when this let field should be replicated for each
-	// incarnation. This is the case when its expression refers to the
-	// variables of a for comprehension embedded within a struct.
-	IsMulti bool
-	Value   Expr
-}
-
-func (x *LetField) Source() ast.Node {
-	if x.Src == nil {
-		return nil
-	}
-	return x.Src
-}
-
 // A BulkOptionalField represents a set of optional field.
 //
-//	[expr]: expr
+//   [expr]: expr
+//
 type BulkOptionalField struct {
 	Src    *ast.Field // Elipsis or Field
 	Filter Expr
@@ -265,7 +241,8 @@ func (x *BulkOptionalField) Source() ast.Node {
 
 // A Ellipsis represents a set of optional fields of a given type.
 //
-//	...T
+//   ...T
+//
 type Ellipsis struct {
 	Src   *ast.Ellipsis
 	Value Expr
@@ -280,8 +257,9 @@ func (x *Ellipsis) Source() ast.Node {
 
 // A DynamicField represents a regular field for which the key is computed.
 //
-//	"\(expr)": expr
-//	(expr): expr
+//    "\(expr)": expr
+//    (expr): expr
+//
 type DynamicField struct {
 	Src   *ast.Field
 	Key   Expr
@@ -301,7 +279,8 @@ func (x *DynamicField) Source() ast.Node {
 
 // A ListLit represents an unevaluated list literal.
 //
-//	[a, for x in src { ... }, b, ...T]
+//    [a, for x in src { ... }, b, ...T]
+//
 type ListLit struct {
 	Src *ast.ListLit
 
@@ -318,14 +297,14 @@ func (x *ListLit) Source() ast.Node {
 	return x.Src
 }
 
-func (x *ListLit) evaluate(c *OpContext, state VertexStatus) Value {
+func (x *ListLit) evaluate(c *OpContext) Value {
 	e := c.Env(0)
 	v := &Vertex{
 		Parent:    e.Vertex,
-		IsDynamic: true,
-		Conjuncts: []Conjunct{{e, x, c.ci}},
+		Conjuncts: []Conjunct{{e, x, CloseInfo{}}},
 	}
-	c.Unify(v, Conjuncts)
+	// TODO: should be AllArcs and then use Finalize for builtins?
+	c.Unify(v, Finalized) // TODO: also partial okay?
 	return v
 }
 
@@ -440,10 +419,11 @@ func (x *Top) Kind() Kind { return TopKind }
 // BasicType represents all values of a certain Kind. It can be used as a Value
 // and Expr.
 //
-//	string
-//	int
-//	num
-//	bool
+//   string
+//   int
+//   num
+//   bool
+//
 type BasicType struct {
 	Src ast.Node
 	K   Kind
@@ -472,8 +452,9 @@ func (x *BasicType) Kind() Kind { return x.K }
 
 // BoundExpr represents an unresolved unary comparator.
 //
-//	<a
-//	=~MyPattern
+//    <a
+//    =~MyPattern
+//
 type BoundExpr struct {
 	Src  *ast.UnaryExpr
 	Op   Op
@@ -487,8 +468,8 @@ func (x *BoundExpr) Source() ast.Node {
 	return x.Src
 }
 
-func (x *BoundExpr) evaluate(ctx *OpContext, state VertexStatus) Value {
-	v := ctx.value(x.Expr, Partial)
+func (x *BoundExpr) evaluate(ctx *OpContext) Value {
+	v := ctx.value(x.Expr)
 	if isError(v) {
 		return v
 	}
@@ -527,7 +508,7 @@ func (x *BoundExpr) evaluate(ctx *OpContext, state VertexStatus) Value {
 	// evaluation strategy that makes nodes increasingly more specific.
 	//
 	// For instance, a completely different implementation would be to allow
-	// the presence of a concrete value to ignore incomplete errors.
+	// the precense of a concrete value to ignore incomplete errors.
 	//
 	// TODO: consider an alternative approach.
 	switch y := v.(type) {
@@ -604,8 +585,9 @@ func (x *BoundExpr) evaluate(ctx *OpContext, state VertexStatus) Value {
 // A BoundValue is a fully evaluated unary comparator that can be used to
 // validate other values.
 //
-//	<5
-//	=~"Name$"
+//    <5
+//    =~"Name$"
+//
 type BoundValue struct {
 	Src   ast.Expr
 	Op    Op
@@ -722,7 +704,8 @@ func (x *NodeLink) resolve(c *OpContext, state VertexStatus) *Vertex {
 
 // A FieldReference represents a lexical reference to a field.
 //
-//	a
+//    a
+//
 type FieldReference struct {
 	Src     *ast.Ident
 	UpCount int32
@@ -744,9 +727,8 @@ func (x *FieldReference) resolve(c *OpContext, state VertexStatus) *Vertex {
 
 // A ValueReference represents a lexical reference to a value.
 //
-// Example: an X referring to
+//    a: X=b
 //
-//	a: X=b
 type ValueReference struct {
 	Src     *ast.Ident
 	UpCount int32
@@ -770,9 +752,8 @@ func (x *ValueReference) resolve(c *OpContext, state VertexStatus) *Vertex {
 
 // A LabelReference refers to the string or integer value of a label.
 //
-// Example: an X referring to
+//    [X=Pattern]: b: X
 //
-//	[X=Pattern]: b: a
 type LabelReference struct {
 	Src     *ast.Ident
 	UpCount int32
@@ -787,7 +768,7 @@ func (x *LabelReference) Source() ast.Node {
 	return x.Src
 }
 
-func (x *LabelReference) evaluate(ctx *OpContext, state VertexStatus) Value {
+func (x *LabelReference) evaluate(ctx *OpContext) Value {
 	label := ctx.relLabel(x.UpCount)
 	if label == 0 {
 		// There is no label. This may happen if a LabelReference is evaluated
@@ -802,11 +783,9 @@ func (x *LabelReference) evaluate(ctx *OpContext, state VertexStatus) Value {
 
 // A DynamicReference is like a LabelReference, but with a computed label.
 //
-// Example: an X referring to
+//    X=(x): X
+//    X="\(x)": X
 //
-//	X=(x): v
-//	X="\(x)": v
-//	X=[string]: v
 type DynamicReference struct {
 	Src     *ast.Ident
 	UpCount int32
@@ -828,18 +807,10 @@ func (x *DynamicReference) Source() ast.Node {
 	return x.Src
 }
 
-func (x *DynamicReference) EvaluateLabel(ctx *OpContext, env *Environment) Feature {
-	env = env.up(x.UpCount)
-	frame := ctx.PushState(env, x.Src)
-	v := ctx.value(x.Label, Partial)
-	ctx.PopState(frame)
-	return ctx.Label(x, v)
-}
-
 func (x *DynamicReference) resolve(ctx *OpContext, state VertexStatus) *Vertex {
 	e := ctx.Env(x.UpCount)
 	frame := ctx.PushState(e, x.Src)
-	v := ctx.value(x.Label, Partial)
+	v := ctx.value(x.Label)
 	ctx.PopState(frame)
 	f := ctx.Label(x.Label, v)
 	return ctx.lookup(e.Vertex, pos(x), f, state)
@@ -847,11 +818,10 @@ func (x *DynamicReference) resolve(ctx *OpContext, state VertexStatus) *Vertex {
 
 // An ImportReference refers to an imported package.
 //
-// Example: strings in
+//    import "strings"
 //
-//	import "strings"
+//    strings.ToLower("Upper")
 //
-//	strings.ToLower("Upper")
 type ImportReference struct {
 	Src        *ast.Ident
 	ImportPath Feature
@@ -876,9 +846,8 @@ func (x *ImportReference) resolve(ctx *OpContext, state VertexStatus) *Vertex {
 
 // A LetReference evaluates a let expression in its original environment.
 //
-// Example: an X referring to
+//   let X = x
 //
-//	let X = x
 type LetReference struct {
 	Src     *ast.Ident
 	UpCount int32
@@ -893,96 +862,27 @@ func (x *LetReference) Source() ast.Node {
 	return x.Src
 }
 
-func (x *LetReference) resolve(ctx *OpContext, state VertexStatus) *Vertex {
-	e := ctx.Env(x.UpCount)
-	n := e.Vertex
-
-	// No need to Unify n, as Let references can only result from evaluating
-	// an experssion within n, in which case evaluation must already have
-	// started.
-	if n.status < Evaluating {
-		panic("unexpected node state < Evaluating")
+func (x *LetReference) resolve(c *OpContext, state VertexStatus) *Vertex {
+	e := c.Env(x.UpCount)
+	label := e.Vertex.Label
+	if x.X == nil {
+		panic("nil expression")
 	}
+	// Anonymous arc.
+	return &Vertex{Parent: nil, Label: label, Conjuncts: []Conjunct{{e, x.X, CloseInfo{}}}}
+}
 
-	arc := ctx.lookup(n, pos(x), x.Label, state)
-	if arc == nil {
-		return nil
-	}
-
-	// Using a let arc directly saves an allocation, but should not be done
-	// in the following circumstances:
-	// 1) multiple Environments to be resolved for a single let
-	// 2) in case of error: some errors, like structural cycles, may only
-	//    occur when an arc is resolved directly, but not when used in an
-	//    expression. Consider, for instance:
-	//
-	//        a: {
-	//            b: 1
-	//            let X = a  // structural cycle
-	//            c: X.b     // not a structural cycle
-	//        }
-	//
-	//     In other words, a Vertex is not necessarily erroneous when a let
-	//     field contained in that Vertex is erroneous.
-
-	// TODO(order): Do not finalize? Although it is safe to finalize a let
-	// by itself, it is not necessarily safe, at this point, to finalize any
-	// references it makes. Originally, let finalization was requested to
-	// detect cases where multi-mode should be enabled. With the recent compiler
-	// changes, though, this should be detected statically. Leave this on for
-	// now, though, as it is not entirely clear it is fine to remove this.
-	// We can reevaluate this once we have redone some of the planned order of
-	// evaluation work.
-	ctx.Unify(arc, Finalized)
-	b, ok := arc.BaseValue.(*Bottom)
-	if !arc.MultiLet && !ok {
-		return arc
-	}
+func (x *LetReference) evaluate(c *OpContext) Value {
+	e := c.Env(x.UpCount)
 
 	// Not caching let expressions may lead to exponential behavior.
-	// The expr uses the expression of a Let field, which can never be used in
-	// any other context.
-	c := arc.Conjuncts[0]
-	expr := c.Expr()
-	key := cacheKey{expr, arc}
-	v, ok := e.cache[key]
-	if !ok {
-		// Link in the right environment to ensure comprehension context is not
-		// lost. Use a Vertex to piggyback on cycle processing.
-		c.Env = e
-		c.x = expr
-
-		if e.cache == nil {
-			e.cache = map[cacheKey]Value{}
-		}
-		n := &Vertex{
-			Parent:    arc.Parent,
-			Label:     x.Label,
-			IsDynamic: b != nil && b.Code == StructuralCycleError,
-			Conjuncts: []Conjunct{c},
-		}
-		v = n
-		e.cache[key] = n
-		nc := n.getNodeContext(ctx, 0)
-		nc.hasNonCycle = true // Allow a first cycle to be skipped.
-
-		// Parents cannot add more conjuncts to a let expression, so set of
-		// conjuncts is always complete.
-		//
-		// NOTE(let finalization): as this let expression is not recorded as
-		// a subfield within its parent arc, setParentDone will not be called
-		// as part of normal processing. The same is true for finalization.
-		// The use of setParentDone has the additional effect that the arc
-		// will be finalized where it is needed. See the namesake NOTE for the
-		// location where this is triggered.
-		n.setParentDone()
-	}
-	return v.(*Vertex)
+	return e.evalCached(c, x.X)
 }
 
 // A SelectorExpr looks up a fixed field in an expression.
 //
-//	a.sel
+//     X.Sel
+//
 type SelectorExpr struct {
 	Src *ast.SelectorExpr
 	X   Expr
@@ -997,8 +897,8 @@ func (x *SelectorExpr) Source() ast.Node {
 }
 
 func (x *SelectorExpr) resolve(c *OpContext, state VertexStatus) *Vertex {
-	// TODO: the node should really be evaluated as AllConjunctsDone, but the
-	// order of evaluation is slightly off, causing too much to be evaluated.
+	// TODO: the node should really be evaluated as AllArcs, but the order
+	// of evaluation is slightly off, causing too much to be evaluated.
 	// This may especially result in incorrect results when using embedded
 	// scalars.
 	n := c.node(x, x.X, x.Sel.IsRegular(), Partial)
@@ -1006,21 +906,18 @@ func (x *SelectorExpr) resolve(c *OpContext, state VertexStatus) *Vertex {
 		return n
 	}
 	if n.status == Partial {
-		if b := n.state.incompleteErrors(false); b != nil && b.Code < CycleError {
-			c.AddBottom(b)
+		if b := n.state.incompleteErrors(); b != nil && b.Code < CycleError {
+			n.BaseValue = b
 			return n
 		}
 	}
-	// TODO(eval): dynamic nodes should be fully evaluated here as the result
-	// will otherwise be discarded and there will be no other chance to check
-	// the struct is valid.
-
 	return c.lookup(n, x.Src.Sel.Pos(), x.Sel, state)
 }
 
 // IndexExpr is like a selector, but selects an index.
 //
-//	a[index]
+//    X[Index]
+//
 type IndexExpr struct {
 	Src   *ast.IndexExpr
 	X     Expr
@@ -1036,32 +933,29 @@ func (x *IndexExpr) Source() ast.Node {
 
 func (x *IndexExpr) resolve(ctx *OpContext, state VertexStatus) *Vertex {
 	// TODO: support byte index.
-	// TODO: the node should really be evaluated as AllConjunctsDone, but the
-	// order of evaluation is slightly off, causing too much to be evaluated.
+	// TODO: the node should really be evaluated as AllArcs, but the order
+	// of evaluation is slightly off, causing too much to be evaluated.
 	// This may especially result in incorrect results when using embedded
 	// scalars.
 	n := ctx.node(x, x.X, true, Partial)
-	i := ctx.value(x.Index, Partial)
+	i := ctx.value(x.Index)
 	if n == emptyNode {
 		return n
 	}
 	if n.status == Partial {
-		if b := n.state.incompleteErrors(false); b != nil && b.Code < CycleError {
-			ctx.AddBottom(b)
+		if b := n.state.incompleteErrors(); b != nil && b.Code < CycleError {
+			n.BaseValue = b
 			return n
 		}
 	}
-	// TODO(eval): dynamic nodes should be fully evaluated here as the result
-	// will otherwise be discarded and there will be no other chance to check
-	// the struct is valid.
-
 	f := ctx.Label(x.Index, i)
 	return ctx.lookup(n, x.Src.Index.Pos(), f, state)
 }
 
 // A SliceExpr represents a slice operation. (Not currently in spec.)
 //
-//	X[Lo:Hi:Stride]
+//    X[Lo:Hi:Stride]
+//
 type SliceExpr struct {
 	Src    *ast.SliceExpr
 	X      Expr
@@ -1077,10 +971,10 @@ func (x *SliceExpr) Source() ast.Node {
 	return x.Src
 }
 
-func (x *SliceExpr) evaluate(c *OpContext, state VertexStatus) Value {
+func (x *SliceExpr) evaluate(c *OpContext) Value {
 	// TODO: strides
 
-	v := c.value(x.X, Partial)
+	v := c.value(x.X)
 	const as = "slice index"
 
 	switch v := v.(type) {
@@ -1097,10 +991,10 @@ func (x *SliceExpr) evaluate(c *OpContext, state VertexStatus) Value {
 			hi = uint64(len(v.Arcs))
 		)
 		if x.Lo != nil {
-			lo = c.uint64(c.value(x.Lo, Partial), as)
+			lo = c.uint64(c.value(x.Lo), as)
 		}
 		if x.Hi != nil {
-			hi = c.uint64(c.value(x.Hi, Partial), as)
+			hi = c.uint64(c.value(x.Hi), as)
 			if hi > uint64(len(v.Arcs)) {
 				return c.NewErrf("index %d out of range", hi)
 			}
@@ -1130,10 +1024,10 @@ func (x *SliceExpr) evaluate(c *OpContext, state VertexStatus) Value {
 			hi = uint64(len(v.B))
 		)
 		if x.Lo != nil {
-			lo = c.uint64(c.value(x.Lo, Partial), as)
+			lo = c.uint64(c.value(x.Lo), as)
 		}
 		if x.Hi != nil {
-			hi = c.uint64(c.value(x.Hi, Partial), as)
+			hi = c.uint64(c.value(x.Hi), as)
 			if hi > uint64(len(v.B)) {
 				return c.NewErrf("index %d out of range", hi)
 			}
@@ -1152,7 +1046,8 @@ func (x *SliceExpr) evaluate(c *OpContext, state VertexStatus) Value {
 
 // An Interpolation is a string interpolation.
 //
-//	"a \(b) c"
+//    "a \(b) c"
+//
 type Interpolation struct {
 	Src   *ast.Interpolation
 	K     Kind   // string or bytes
@@ -1166,10 +1061,10 @@ func (x *Interpolation) Source() ast.Node {
 	return x.Src
 }
 
-func (x *Interpolation) evaluate(c *OpContext, state VertexStatus) Value {
+func (x *Interpolation) evaluate(c *OpContext) Value {
 	buf := bytes.Buffer{}
 	for _, e := range x.Parts {
-		v := c.value(e, Partial)
+		v := c.value(e)
 		if x.K == BytesKind {
 			buf.Write(c.ToBytes(v))
 		} else {
@@ -1193,8 +1088,9 @@ func (x *Interpolation) evaluate(c *OpContext, state VertexStatus) Value {
 
 // UnaryExpr is a unary expression.
 //
-//	Op X
-//	-X !X +X
+//    Op X
+//    -X !X +X
+//
 type UnaryExpr struct {
 	Src *ast.UnaryExpr
 	Op  Op
@@ -1208,11 +1104,11 @@ func (x *UnaryExpr) Source() ast.Node {
 	return x.Src
 }
 
-func (x *UnaryExpr) evaluate(c *OpContext, state VertexStatus) Value {
+func (x *UnaryExpr) evaluate(c *OpContext) Value {
 	if !c.concreteIsPossible(x.Op, x.X) {
 		return nil
 	}
-	v := c.value(x.X, Partial)
+	v := c.value(x.X)
 	if isError(v) {
 		return v
 	}
@@ -1253,8 +1149,9 @@ func (x *UnaryExpr) evaluate(c *OpContext, state VertexStatus) Value {
 
 // BinaryExpr is a binary expression.
 //
-//	X + Y
-//	X & Y
+//    X + Y
+//    X & Y
+//
 type BinaryExpr struct {
 	Src *ast.BinaryExpr
 	Op  Op
@@ -1269,27 +1166,12 @@ func (x *BinaryExpr) Source() ast.Node {
 	return x.Src
 }
 
-func (x *BinaryExpr) evaluate(c *OpContext, state VertexStatus) Value {
+func (x *BinaryExpr) evaluate(c *OpContext) Value {
 	env := c.Env(0)
 	if x.Op == AndOp {
-		v := &Vertex{
-			IsDynamic: true,
-			Conjuncts: []Conjunct{makeAnonymousConjunct(env, x, c.ci.Refs)},
-		}
-
-		// Do not fully evaluate the Vertex: if it is embedded within a
-		// a struct with arcs that are referenced from within this expression,
-		// it will end up adding "locked" fields, resulting in an error.
-		// It will be the responsibility of the "caller" to get the result
-		// to the required state. If the struct is already dynamic, we will
-		// evaluate the struct regardless to ensure that cycle reporting
-		// keeps working.
-		if env.Vertex.IsDynamic || c.inValidator > 0 {
-			c.Unify(v, Finalized)
-		} else {
-			c.Unify(v, Conjuncts)
-		}
-
+		// Anonymous Arc
+		v := &Vertex{Conjuncts: []Conjunct{{env, x, CloseInfo{}}}}
+		c.Unify(v, Finalized)
 		return v
 	}
 
@@ -1303,10 +1185,10 @@ func (x *BinaryExpr) evaluate(c *OpContext, state VertexStatus) Value {
 	// Bottom here and require that one of the values be a Bottom literal.
 	if x.Op == EqualOp || x.Op == NotEqualOp {
 		if isLiteralBottom(x.X) {
-			return c.validate(env, x.Src, x.Y, x.Op, state)
+			return c.validate(env, x.Src, x.Y, x.Op)
 		}
 		if isLiteralBottom(x.Y) {
-			return c.validate(env, x.Src, x.X, x.Op, state)
+			return c.validate(env, x.Src, x.X, x.Op)
 		}
 	}
 
@@ -1324,48 +1206,32 @@ func (x *BinaryExpr) evaluate(c *OpContext, state VertexStatus) Value {
 	return BinOp(c, x.Op, left, right)
 }
 
-func (c *OpContext) validate(env *Environment, src ast.Node, x Expr, op Op, state VertexStatus) (r Value) {
+func (c *OpContext) validate(env *Environment, src ast.Node, x Expr, op Op) (r Value) {
 	s := c.PushState(env, src)
-
-	match := op != EqualOp // non-error case
-
-	// Like value(), but retain the original, unwrapped result.
-	c.inValidator++
-	v := c.evalState(x, state)
-	c.inValidator--
-	u, _ := c.getDefault(v)
-	u = Unwrap(u)
-
-	// If our final (unwrapped) value is potentially a recursive structure, we
-	// still need to recursively check for errors. We do so by treating it
-	// as the original value, which if it is a Vertex will be evaluated
-	// recursively below.
-	if u != nil && u.Kind().IsAnyOf(StructKind|ListKind) {
-		u = v
+	if c.nonMonotonicLookupNest == 0 {
+		c.nonMonotonicGeneration++
 	}
 
-	switch v := u.(type) {
+	var match bool
+	// NOTE: using Unwrap is maybe note entirely accurate, as it may discard
+	// a future error. However, if it does so, the error will at least be
+	// reported elsewhere.
+	switch b := c.value(x).(type) {
 	case nil:
 	case *Bottom:
-		switch v.Code {
-		case CycleError:
+		if b.Code == CycleError {
 			c.PopState(s)
-			c.AddBottom(v)
-			// TODO: add this. This erases some
-			// c.verifyNonMonotonicResult(env, x, true)
+			c.AddBottom(b)
 			return nil
-
-		case IncompleteError:
-			c.evalState(x, Finalized)
-
-			// We have a nonmonotonic use of a failure. Referenced fields should
-			// not be added anymore.
-			c.verifyNonMonotonicResult(env, x, true)
 		}
-
 		match = op == EqualOp
+		// We have a nonmonotonic use of a failure. Referenced fields should
+		// not be added anymore.
+		c.nonMonotonicRejectNest++
+		c.evalState(x, Partial)
+		c.nonMonotonicRejectNest--
 
-	case *Vertex:
+	default:
 		// TODO(cycle): if EqualOp:
 		// - ensure to pass special status to if clause or keep a track of "hot"
 		//   paths.
@@ -1373,88 +1239,30 @@ func (c *OpContext) validate(env *Environment, src ast.Node, x Expr, op Op, stat
 		// - walk over all fields and verify that fields are not contradicting
 		//   previously marked fields.
 		//
-		c.Unify(v, Finalized)
-
-		if v.status == EvaluatingArcs {
-			// We have a cycle, which may be an error. Cycle errors may occur
-			// in chains that are themselves not a cycle. It suffices to check
-			// for non-monotonic results at the end for this particular path.
-			// TODO(perf): finding the right path through such comprehensions
-			// may be expensive. Finding a path in a directed graph is O(n),
-			// though, so we should ensure that the implementation conforms to
-			// this.
-			c.verifyNonMonotonicResult(env, x, true)
-			match = op == EqualOp
-			break
-		}
-
 		switch {
-		case !v.IsDefined(c):
-			c.verifyNonMonotonicResult(env, x, true) // TODO: remove?
-
-			// TODO: mimic comparison to bottom semantics. If it is a valid
-			// value, check for concreteness that this level only. This
-			// should ultimately be replaced with an exists and valid
-			// builtin.
-			match = op == EqualOp
-
-		case isFinalError(v):
-			// Need to recursively check for errors, so we need to evaluate the
-			// Vertex in case it hadn't been evaluated yet.
-			match = op == EqualOp
-		}
-
-	default:
-		if v.Kind().IsAnyOf(CompositKind) && v.Concreteness() > Concrete && state < Conjuncts {
-			c.PopState(s)
-			c.AddBottom(cycle)
-			return nil
-		}
-
-		c.verifyNonMonotonicResult(env, x, false)
-
-		if v.Concreteness() > Concrete {
+		case b.Concreteness() > Concrete:
 			// TODO: mimic comparison to bottom semantics. If it is a valid
 			// value, check for concreteness that this level only. This
 			// should ultimately be replaced with an exists and valid
 			// builtin.
 			match = op == EqualOp
+		default:
+			match = op != EqualOp
 		}
-
+		c.nonMonotonicLookupNest++
 		c.evalState(x, Partial)
+		c.nonMonotonicLookupNest--
 	}
 
 	c.PopState(s)
 	return &Bool{src, match}
 }
 
-func isFinalError(n *Vertex) bool {
-	n = n.Indirect()
-	if b, ok := Unwrap(n).(*Bottom); ok && b.Code < IncompleteError {
-		return true
-	}
-	return false
-}
-
-// verifyNonMonotonicResult re-evaluates the given expression at a later point
-// to ensure that the result has not changed. This is relevant when a function
-// uses reflection, as in `if a != _|_`, where the result of an evaluation may
-// change after the fact.
-// expectError indicates whether the value should evaluate to an error or not.
-func (c *OpContext) verifyNonMonotonicResult(env *Environment, x Expr, expectError bool) {
-	if n := env.Vertex.getNodeContext(c, 0); n != nil {
-		n.postChecks = append(n.postChecks, envCheck{
-			env:         env,
-			expr:        x,
-			expectError: expectError,
-		})
-	}
-}
-
 // A CallExpr represents a call to a builtin.
 //
-//	len(x)
-//	strings.ToLower(x)
+//    len(x)
+//    strings.ToLower(x)
+//
 type CallExpr struct {
 	Src  *ast.CallExpr
 	Fun  Expr
@@ -1468,8 +1276,8 @@ func (x *CallExpr) Source() ast.Node {
 	return x.Src
 }
 
-func (x *CallExpr) evaluate(c *OpContext, state VertexStatus) Value {
-	fun := c.value(x.Fun, Partial)
+func (x *CallExpr) evaluate(c *OpContext) Value {
+	fun := c.value(x.Fun)
 	var b *Builtin
 	switch f := fun.(type) {
 	case *Builtin:
@@ -1497,27 +1305,23 @@ func (x *CallExpr) evaluate(c *OpContext, state VertexStatus) Value {
 	}
 	args := []Value{}
 	for i, a := range x.Args {
-		saved := c.errs
-		c.errs = nil
-		expr := c.value(a, state)
-
+		expr := c.value(a)
 		switch v := expr.(type) {
 		case nil:
-			if c.errs == nil {
-				// There SHOULD be an error in the context. If not, we generate
-				// one.
-				c.Assertf(pos(x.Fun), c.HasErr(),
-					"argument %d to function %s is incomplete", i, x.Fun)
-			}
+			// There SHOULD be an error in the context. If not, we generate
+			// one.
+			c.Assertf(pos(x.Fun), c.HasErr(),
+				"argument %d to function %s is incomplete", i, x.Fun)
 
 		case *Bottom:
 			// TODO(errors): consider adding an argument index for this errors.
-			c.errs = CombineErrors(a.Source(), c.errs, v)
+			// On the other hand, this error is really not related to the
+			// argument itself, so maybe it is good as it is.
+			c.AddBottom(v)
 
 		default:
 			args = append(args, expr)
 		}
-		c.errs = CombineErrors(a.Source(), saved, c.errs)
 	}
 	if c.HasErr() {
 		return nil
@@ -1525,7 +1329,7 @@ func (x *CallExpr) evaluate(c *OpContext, state VertexStatus) Value {
 	if b.IsValidator(len(args)) {
 		return &BuiltinValidator{x, b, args}
 	}
-	result := b.call(c, pos(x), false, args)
+	result := b.call(c, pos(x), args)
 	if result == nil {
 		return nil
 	}
@@ -1595,7 +1399,7 @@ func bottom(v Value) *Bottom {
 	return b
 }
 
-func (x *Builtin) call(c *OpContext, p token.Pos, validate bool, args []Value) Expr {
+func (x *Builtin) call(c *OpContext, p token.Pos, args []Value) Expr {
 	fun := x // right now always x.
 	if len(args) > len(x.Params) {
 		c.addErrf(0, p,
@@ -1635,10 +1439,7 @@ func (x *Builtin) call(c *OpContext, p token.Pos, validate bool, args []Value) E
 		if _, ok := v.(*BasicType); !ok {
 			env := c.Env(0)
 			x := &BinaryExpr{Op: AndOp, X: v, Y: a}
-			n := &Vertex{
-				IsDynamic: true,
-				Conjuncts: []Conjunct{{env, x, c.ci}},
-			}
+			n := &Vertex{Conjuncts: []Conjunct{{env, x, CloseInfo{}}}}
 			c.Unify(n, Finalized)
 			if _, ok := n.BaseValue.(*Bottom); ok {
 				c.addErrf(0, pos(a),
@@ -1649,12 +1450,7 @@ func (x *Builtin) call(c *OpContext, p token.Pos, validate bool, args []Value) E
 			args[i] = n
 		}
 	}
-	saved := c.IsValidator
-	c.IsValidator = validate
-	ret := x.Func(c, args)
-	c.IsValidator = saved
-
-	return ret
+	return x.Func(c, args)
 }
 
 func (x *Builtin) Source() ast.Node { return nil }
@@ -1662,7 +1458,8 @@ func (x *Builtin) Source() ast.Node { return nil }
 // A BuiltinValidator is a Value that results from evaluation a partial call
 // to a builtin (using CallExpr).
 //
-//	strings.MinRunes(4)
+//    strings.MinRunes(4)
+//
 type BuiltinValidator struct {
 	Src     *CallExpr
 	Builtin *Builtin
@@ -1699,7 +1496,7 @@ func validateWithBuiltin(c *OpContext, src token.Pos, b *Builtin, args []Value)
 	var severeness ErrorCode
 	var err errors.Error
 
-	res := b.call(c, src, true, args)
+	res := b.call(c, src, args)
 	switch v := res.(type) {
 	case nil:
 		return nil
@@ -1734,12 +1531,6 @@ func validateWithBuiltin(c *OpContext, src token.Pos, b *Builtin, args []Value)
 		buf.WriteString(")")
 	}
 
-	// If the validator returns an error and we already had an error, just
-	// return the original error.
-	if b, ok := Unwrap(args[0]).(*Bottom); ok {
-		return b
-	}
-
 	vErr := c.NewPosf(src, "invalid value %s (does not satisfy %s)", args[0], buf.String())
 
 	for _, v := range args {
@@ -1771,9 +1562,9 @@ func (x *DisjunctionExpr) Source() ast.Node {
 	return x.Src
 }
 
-func (x *DisjunctionExpr) evaluate(c *OpContext, state VertexStatus) Value {
+func (x *DisjunctionExpr) evaluate(c *OpContext) Value {
 	e := c.Env(0)
-	v := &Vertex{Conjuncts: []Conjunct{{e, x, c.ci}}}
+	v := &Vertex{Conjuncts: []Conjunct{{e, x, CloseInfo{}}}}
 	c.Unify(v, Finalized) // TODO: also partial okay?
 	// TODO: if the disjunction result originated from a literal value, we may
 	// consider the result closed to create more permanent errors.
@@ -1822,65 +1613,28 @@ func (x *Disjunction) Kind() Kind {
 }
 
 type Comprehension struct {
-	Syntax ast.Node
-
-	// Clauses is the list of for, if, and other clauses of a comprehension,
-	// not including the yielded value (in curly braces).
-	Clauses []Yielder
-
-	// Value can be either a StructLit if this is a compiled expression or
-	// a Field if this is a computed Comprehension. Value holds a Field,
-	// rather than an Expr, in the latter case to preserve as much position
-	// information as possible.
-	Value Node
-
-	// Only used for partial comprehensions.
-	comp   *envComprehension
-	parent *Comprehension // comprehension from which this one was derived, if any
-	arc    *Vertex        // arc to which this comprehension was added.
-}
-
-// Nest returns the nesting level of void arcs of this comprehension.
-func (c *Comprehension) Nest() int {
-	count := 0
-	for ; c.parent != nil; c = c.parent {
-		count++
-	}
-	return count
-}
-
-// Envs returns all Environments yielded from an evaluated comprehension.
-// Together with the Comprehension value, each Environment represents a
-// result value of the comprehension.
-func (c *Comprehension) Envs() []*Environment {
-	if c.comp == nil {
-		return nil
-	}
-	return c.comp.envs
-}
-
-// DidResolve reports whether a comprehension was processed and resulted in at
-// least one yielded value.
-func (x *Comprehension) DidResolve() bool {
-	return x.comp.done && len(x.comp.envs) > 0
+	Clauses Yielder
+	Value   Expr
 }
 
 func (x *Comprehension) Source() ast.Node {
-	if x.Syntax == nil {
+	if x.Clauses == nil {
 		return nil
 	}
-	return x.Syntax
+	return x.Clauses.Source()
 }
 
 // A ForClause represents a for clause of a comprehension. It can be used
 // as a struct or list element.
 //
-//	for k, v in src {}
+//    for k, v in src {}
+//
 type ForClause struct {
 	Syntax *ast.ForClause
 	Key    Feature
 	Value  Feature
 	Src    Expr
+	Dst    Yielder
 }
 
 func (x *ForClause) Source() ast.Node {
@@ -1890,47 +1644,21 @@ func (x *ForClause) Source() ast.Node {
 	return x.Syntax
 }
 
-func (x *ForClause) yield(s *compState) {
-	c := s.ctx
-	n := c.node(x, x.Src, true, Conjuncts)
-	if n.status == Evaluating && !n.LockArcs {
-		c.AddBottom(&Bottom{
-			Code:     CycleError,
-			ForCycle: true,
-			Value:    n,
-			Err:      errors.Newf(pos(x.Src), "comprehension source references itself"),
-		})
-		return
-	}
-	if c.HasErr() {
-		return
-	}
-	n.LockArcs = true
+func (x *ForClause) yield(c *OpContext, f YieldFunc) {
+	n := c.node(x, x.Src, true, Finalized)
 	for _, a := range n.Arcs {
-		if !a.Label.IsRegular() || !a.IsDefined(c) {
+		if !a.Label.IsRegular() {
 			continue
 		}
 
 		c.Unify(a, Partial)
-		if a.arcType == arcVoid {
-			continue
-		}
 
-		n := &Vertex{
-			Parent: c.Env(0).Vertex,
-
-			// Using Finalized here ensures that no nodeContext is allocated,
-			// preventing a leak, as this "helper" struct bypasses normal
-			// processing, eluding the deallocation step.
-			status:    Finalized,
-			IsDynamic: true,
-		}
+		n := &Vertex{status: Finalized}
 
 		if x.Value != InvalidLabel {
 			b := &Vertex{
 				Label:     x.Value,
 				BaseValue: a,
-				IsDynamic: true,
 			}
 			n.Arcs = append(n.Arcs, b)
 		}
@@ -1944,7 +1672,13 @@ func (x *ForClause) yield(s *compState) {
 		}
 
 		sub := c.spawn(n)
-		if !s.yield(sub) {
+		saved := c.PushState(sub, x.Dst.Source())
+		x.Dst.yield(c, f)
+		if b := c.PopState(saved); b != nil {
+			c.AddBottom(b)
+			break
+		}
+		if c.HasErr() {
 			break
 		}
 	}
@@ -1953,10 +1687,12 @@ func (x *ForClause) yield(s *compState) {
 // An IfClause represents an if clause of a comprehension. It can be used
 // as a struct or list element.
 //
-//	if cond {}
+//    if cond {}
+//
 type IfClause struct {
 	Src       *ast.IfClause
 	Condition Expr
+	Dst       Yielder
 }
 
 func (x *IfClause) Source() ast.Node {
@@ -1966,20 +1702,21 @@ func (x *IfClause) Source() ast.Node {
 	return x.Src
 }
 
-func (x *IfClause) yield(s *compState) {
-	ctx := s.ctx
-	if ctx.BoolValue(ctx.value(x.Condition, s.state)) {
-		s.yield(ctx.e)
+func (x *IfClause) yield(ctx *OpContext, f YieldFunc) {
+	if ctx.BoolValue(ctx.value(x.Condition)) {
+		x.Dst.yield(ctx, f)
 	}
 }
 
-// A LetClause represents a let clause in a comprehension.
+// An LetClause represents a let clause in a comprehension.
+//
+//    let x = y
 //
-//	let x = y
 type LetClause struct {
 	Src   *ast.LetClause
 	Label Feature
 	Expr  Expr
+	Dst   Yielder
 }
 
 func (x *LetClause) Source() ast.Node {
@@ -1989,15 +1726,34 @@ func (x *LetClause) Source() ast.Node {
 	return x.Src
 }
 
-func (x *LetClause) yield(s *compState) {
-	c := s.ctx
+func (x *LetClause) yield(c *OpContext, f YieldFunc) {
 	n := &Vertex{Arcs: []*Vertex{
-		{
-			Label:     x.Label,
-			IsDynamic: true,
-			Conjuncts: []Conjunct{{c.Env(0), x.Expr, c.ci}},
-		},
+		{Label: x.Label, Conjuncts: []Conjunct{{c.Env(0), x.Expr, CloseInfo{}}}},
 	}}
 
-	s.yield(c.spawn(n))
+	sub := c.spawn(n)
+	saved := c.PushState(sub, x.Dst.Source())
+	x.Dst.yield(c, f)
+	if b := c.PopState(saved); b != nil {
+		c.AddBottom(b)
+	}
+}
+
+// A ValueClause represents the value part of a comprehension.
+type ValueClause struct {
+	*StructLit
+}
+
+func (x *ValueClause) Source() ast.Node {
+	if x.StructLit == nil {
+		return nil
+	}
+	if x.Src == nil {
+		return nil
+	}
+	return x.Src
+}
+
+func (x *ValueClause) yield(op *OpContext, f YieldFunc) {
+	f(op.Env(0))
 }
diff --git a/vendor/cuelang.org/go/internal/core/adt/feature.go b/vendor/cuelang.org/go/internal/core/adt/feature.go
index 795c49434..26d6c9301 100644
--- a/vendor/cuelang.org/go/internal/core/adt/feature.go
+++ b/vendor/cuelang.org/go/internal/core/adt/feature.go
@@ -37,7 +37,7 @@ const (
 	InvalidLabel Feature = 0
 
 	// MaxIndex indicates the maximum number of unique strings that are used for
-	// labels within this CUE implementation.
+	// labeles within this CUE implementation.
 	MaxIndex = 1<<(32-indexShift) - 1
 )
 
@@ -60,9 +60,6 @@ type StringIndexer interface {
 
 	// ToString returns a string s for index such that ToIndex(s) == index.
 	IndexToString(index int64) string
-
-	// NextUniqueID returns a new unique identifier.
-	NextUniqueID() uint64
 }
 
 // SelectorString reports the shortest string representation of f when used as a
@@ -71,18 +68,12 @@ func (f Feature) SelectorString(index StringIndexer) string {
 	x := f.safeIndex()
 	switch f.Typ() {
 	case IntLabel:
-		if f == AnyIndex {
-			return "_"
-		}
 		return strconv.Itoa(int(x))
 	case StringLabel:
 		s := index.IndexToString(x)
 		if ast.IsValidIdent(s) && !internal.IsDefOrHidden(s) {
 			return s
 		}
-		if f == AnyString {
-			return "_"
-		}
 		return literal.String.Quote(s)
 	default:
 		return f.IdentString(index)
@@ -93,7 +84,7 @@ func (f Feature) SelectorString(index StringIndexer) string {
 // is not an identifier label.
 func (f Feature) IdentString(index StringIndexer) string {
 	s := index.IndexToString(f.safeIndex())
-	if f.IsHidden() || f.IsLet() {
+	if f.IsHidden() {
 		if p := strings.IndexByte(s, '\x00'); p >= 0 {
 			s = s[:p]
 		}
@@ -124,12 +115,6 @@ func (f Feature) StringValue(index StringIndexer) string {
 	return index.IndexToString(x)
 }
 
-// RawString reports the underlying string value of f without interpretation.
-func (f Feature) RawString(index StringIndexer) string {
-	x := f.safeIndex()
-	return index.IndexToString(x)
-}
-
 // ToValue converts a label to a value, which will be a Num for integer labels
 // and a String for string labels. It panics when f is not a regular label.
 func (f Feature) ToValue(ctx *OpContext) Value {
@@ -168,11 +153,11 @@ func MakeIdentLabel(r StringIndexer, s, pkgpath string) Feature {
 	switch {
 	case strings.HasPrefix(s, "_#"):
 		t = HiddenDefinitionLabel
-		s = HiddenKey(s, pkgpath)
+		s = fmt.Sprintf("%s\x00%s", s, pkgpath)
 	case strings.HasPrefix(s, "#"):
 		t = DefinitionLabel
 	case strings.HasPrefix(s, "_"):
-		s = HiddenKey(s, pkgpath)
+		s = fmt.Sprintf("%s\x00%s", s, pkgpath)
 		t = HiddenLabel
 	}
 	i := r.StringToIndex(s)
@@ -183,54 +168,9 @@ func MakeIdentLabel(r StringIndexer, s, pkgpath string) Feature {
 	return f
 }
 
-// HiddenKey constructs the uniquely identifying string for a hidden fields and
-// its package.
-func HiddenKey(s, pkgPath string) string {
-	// TODO: Consider just using space instead of \x00.
-	return fmt.Sprintf("%s\x00%s", s, pkgPath)
-}
-
-// MakeNamedLabel creates a feature for the given name and feature type.
-func MakeNamedLabel(r StringIndexer, t FeatureType, s string) Feature {
-	i := r.StringToIndex(s)
-	f, err := MakeLabel(nil, i, t)
-	if err != nil {
-		panic("out of free string slots")
-	}
-	return f
-}
-
-// MakeLetLabel creates a label for the given let identifier s.
-//
-// A let declaration is always logically unique within its scope and will never
-// unify with a let field of another struct. This is enforced by ensuring that
-// the let identifier is unique across an entire configuration. This, in turn,
-// is done by adding a unique number to each let identifier.
-func MakeLetLabel(r StringIndexer, s string) Feature {
-	id := r.NextUniqueID()
-	s = fmt.Sprintf("%s\x00%X", s, id)
-	i := r.StringToIndex(s)
-	f, err := MakeLabel(nil, i, LetLabel)
-	if err != nil {
-		panic("out of free string slots")
-	}
-	return f
-}
-
-// MakeIntLabel creates an integer label.
-func MakeIntLabel(t FeatureType, i int64) Feature {
-	f, err := MakeLabel(nil, i, t)
-	if err != nil {
-		panic("index out of range")
-	}
-	return f
-}
-
 const msgGround = "invalid non-ground value %s (must be concrete %s)"
 
 func labelFromValue(c *OpContext, src Expr, v Value) Feature {
-	v, _ = c.getDefault(v)
-
 	var i int64
 	var t FeatureType
 	if isError(v) {
@@ -320,7 +260,6 @@ const (
 	DefinitionLabel
 	HiddenLabel
 	HiddenDefinitionLabel
-	LetLabel
 )
 
 const (
@@ -337,10 +276,6 @@ func (f FeatureType) IsHidden() bool {
 	return f == HiddenLabel || f == HiddenDefinitionLabel
 }
 
-func (f FeatureType) IsLet() bool {
-	return f == LetLabel
-}
-
 // IsValid reports whether f is a valid label.
 func (f Feature) IsValid() bool { return f != InvalidLabel }
 
@@ -357,7 +292,7 @@ func (f Feature) IsRegular() bool {
 func (f Feature) IsString() bool { return f.Typ() == StringLabel }
 
 // IsDef reports whether the label is a definition (an identifier starting with
-// # or _#.
+// # or #_.
 func (f Feature) IsDef() bool {
 	return f.Typ().IsDef()
 }
@@ -371,11 +306,6 @@ func (f Feature) IsHidden() bool {
 	return f.Typ().IsHidden()
 }
 
-// IsLet reports whether this label is a let field (like `let X = value`).
-func (f Feature) IsLet() bool {
-	return f.Typ().IsLet()
-}
-
 // Index reports the abstract index associated with f.
 func (f Feature) Index() int {
 	return int(f >> indexShift)
diff --git a/vendor/cuelang.org/go/internal/core/adt/kind.go b/vendor/cuelang.org/go/internal/core/adt/kind.go
index 17c128049..1c3bd7e75 100644
--- a/vendor/cuelang.org/go/internal/core/adt/kind.go
+++ b/vendor/cuelang.org/go/internal/core/adt/kind.go
@@ -79,8 +79,6 @@ const (
 	TopKind     Kind = (allKinds - 1) // all kinds, but not references
 	ScalarKinds      = NullKind | BoolKind |
 		IntKind | FloatKind | StringKind | BytesKind
-
-	CompositKind = StructKind | ListKind
 )
 
 func kind(v Value) Kind {
diff --git a/vendor/cuelang.org/go/internal/core/adt/optional.go b/vendor/cuelang.org/go/internal/core/adt/optional.go
index 573c6b23b..d4eed6311 100644
--- a/vendor/cuelang.org/go/internal/core/adt/optional.go
+++ b/vendor/cuelang.org/go/internal/core/adt/optional.go
@@ -51,24 +51,15 @@ outer:
 	if len(o.Bulk) > 0 {
 		bulkEnv := *env
 		bulkEnv.DynamicLabel = f
+		bulkEnv.Deref = nil
+		bulkEnv.Cycles = nil
 
 		// match bulk optional fields / pattern properties
 		for _, b := range o.Bulk {
 			// if matched && f.additional {
 			// 	continue
 			// }
-
-			// Mark the current arc as cyclic while evaluating pattern
-			// expressions, but not while adding conjuncts.
-			// TODO: make MatchAndInsert return a list of conjuncts instead?
-			// TODO: it could be that we can set the cycle before calling
-			// MatchAndInsert after the renewed implementation of disjunctions.
-			saved := arc.BaseValue
-			arc.BaseValue = cycle
-			match := matchBulk(c, env, b, f, label)
-			arc.BaseValue = saved
-
-			if match {
+			if matchBulk(c, env, b, f, label) {
 				matched = true
 				info := closeInfo.SpawnSpan(b.Value, ConstraintSpan)
 				arc.AddConjunct(MakeConjunct(&bulkEnv, b, info))
@@ -80,6 +71,10 @@ outer:
 		return
 	}
 
+	addEnv := *env
+	addEnv.Deref = nil
+	addEnv.Cycles = nil
+
 	// match others
 	for _, x := range o.Additional {
 		info := closeInfo
@@ -87,28 +82,19 @@ outer:
 			info = info.SpawnSpan(x, ConstraintSpan)
 		}
 		// TODO: consider moving in above block (2 lines up).
-		arc.AddConjunct(MakeConjunct(env, x, info))
+		arc.AddConjunct(MakeConjunct(&addEnv, x, info))
 	}
 }
 
 // matchBulk reports whether feature f matches the filter of x. It evaluation of
 // the filter is erroneous, it returns false and the error will  be set in c.
-func matchBulk(c *OpContext, env *Environment, p *BulkOptionalField, f Feature, label Value) bool {
-	v := env.evalCached(c, p.Filter)
+func matchBulk(c *OpContext, env *Environment, x *BulkOptionalField, f Feature, label Value) bool {
+	v := env.evalCached(c, x.Filter)
 	v = Unwrap(v)
 
 	// Fast-track certain cases.
 	switch x := v.(type) {
 	case *Bottom:
-		if x == cycle {
-			err := c.NewPosf(pos(p.Filter), "cyclic pattern constraint")
-			for _, c := range c.vertex.Conjuncts {
-				err.AddPosition(c.Elem())
-			}
-			c.AddBottom(&Bottom{
-				Err: err,
-			})
-		}
 		if c.errs == nil {
 			c.AddBottom(x)
 		}
@@ -137,12 +123,10 @@ func matchBulk(c *OpContext, env *Environment, p *BulkOptionalField, f Feature,
 		return false
 	}
 
-	n := Vertex{
-		IsDynamic: true,
-	}
-	m := MakeConjunct(env, v, c.ci)
+	n := Vertex{}
+	m := MakeRootConjunct(env, v)
 	n.AddConjunct(m)
-	n.AddConjunct(MakeConjunct(m.Env, label, c.ci))
+	n.AddConjunct(MakeRootConjunct(m.Env, label))
 
 	c.inConstraint++
 	n.Finalize(c)
diff --git a/vendor/cuelang.org/go/internal/core/adt/prof.go b/vendor/cuelang.org/go/internal/core/adt/prof.go
deleted file mode 100644
index 3036b273f..000000000
--- a/vendor/cuelang.org/go/internal/core/adt/prof.go
+++ /dev/null
@@ -1,47 +0,0 @@
-// Copyright 2023 CUE Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package adt
-
-import (
-	"sync"
-
-	"cuelang.org/go/cue/stats"
-)
-
-// This file contains stats and profiling functionality.
-
-var (
-	// counts is a temporary and internal solution for collecting global stats. It is protected with a mutex.
-	counts   stats.Counts
-	countsMu sync.Mutex
-)
-
-// AddStats adds the stats of the given OpContext to the global
-// counters.
-func AddStats(ctx *OpContext) {
-	countsMu.Lock()
-	counts.Add(ctx.stats)
-	countsMu.Unlock()
-}
-
-// TotalStats returns the aggregate counts of all operations
-// calling AddStats.
-func TotalStats() stats.Counts {
-	countsMu.Lock()
-	// Shallow copy suffices as it only contains counter fields.
-	s := counts
-	countsMu.Unlock()
-	return s
-}
diff --git a/vendor/cuelang.org/go/internal/core/compile/builtin.go b/vendor/cuelang.org/go/internal/core/compile/builtin.go
index 41b13fcfc..1b8d71e1f 100644
--- a/vendor/cuelang.org/go/internal/core/compile/builtin.go
+++ b/vendor/cuelang.org/go/internal/core/compile/builtin.go
@@ -37,7 +37,6 @@ var lenBuiltin = &adt.Builtin{
 	Func: func(c *adt.OpContext, args []adt.Value) adt.Expr {
 		v := args[0]
 		if x, ok := v.(*adt.Vertex); ok {
-			x.LockArcs = true
 			switch x.BaseValue.(type) {
 			case nil:
 				// This should not happen, but be defensive.
@@ -49,7 +48,7 @@ var lenBuiltin = &adt.Builtin{
 				n := 0
 				v, _ := v.(*adt.Vertex)
 				for _, a := range v.Arcs {
-					if a.Label.IsRegular() && a.IsDefined(c) {
+					if a.Label.IsRegular() {
 						n++
 					}
 				}
@@ -86,7 +85,7 @@ var closeBuiltin = &adt.Builtin{
 		if !ok {
 			return c.NewErrf("struct argument must be concrete")
 		}
-		if m, ok := s.BaseValue.(*adt.StructMarker); ok && m.NeedClose || s.Closed {
+		if s.IsClosedStruct() {
 			return s
 		}
 		v := s.Clone()
@@ -102,7 +101,7 @@ var andBuiltin = &adt.Builtin{
 	Params: []adt.Param{listParam},
 	Result: adt.IntKind,
 	Func: func(c *adt.OpContext, args []adt.Value) adt.Expr {
-		list := c.RawElems(args[0])
+		list := c.Elems(args[0])
 		if len(list) == 0 {
 			return &adt.Top{}
 		}
@@ -120,7 +119,7 @@ var orBuiltin = &adt.Builtin{
 	Result: adt.IntKind,
 	Func: func(c *adt.OpContext, args []adt.Value) adt.Expr {
 		d := []adt.Disjunct{}
-		for _, c := range c.RawElems(args[0]) {
+		for _, c := range c.Elems(args[0]) {
 			d = append(d, adt.Disjunct{Val: c, Default: false})
 		}
 		if len(d) == 0 {
@@ -138,12 +137,10 @@ var orBuiltin = &adt.Builtin{
 		}
 		v := &adt.Vertex{}
 		// TODO: make a Disjunction.
-		closeInfo := c.CloseInfo()
-		v.AddConjunct(adt.MakeConjunct(nil,
+		v.AddConjunct(adt.MakeRootConjunct(nil,
 			&adt.DisjunctionExpr{Values: d, HasDefaults: false},
-			closeInfo,
 		))
-		c.Unify(v, adt.Conjuncts)
+		c.Unify(v, adt.Finalized)
 		return v
 	},
 }
diff --git a/vendor/cuelang.org/go/internal/core/compile/compile.go b/vendor/cuelang.org/go/internal/core/compile/compile.go
index 06fccc3aa..18fa53be4 100644
--- a/vendor/cuelang.org/go/internal/core/compile/compile.go
+++ b/vendor/cuelang.org/go/internal/core/compile/compile.go
@@ -105,17 +105,6 @@ type compiler struct {
 	stack      []frame
 	inSelector int
 
-	// refersToForVariable tracks whether an expression refers to a key or
-	// value produced by a for comprehension embedded within a struct.
-	// An Environment associated with such a comprehension value is collapsed
-	// onto the destination.
-	// Tracking this is necessary for let fields, which should not be unified
-	// into the destination when referring to such values.
-	// See https://cuelang.org/issue/2218.
-	// TODO(perf): use this to compute when a field can be structure shared
-	// across different iterations of the same field.
-	refersToForVariable bool
-
 	fileScope map[adt.Feature]bool
 
 	num literal.NumInfo
@@ -152,14 +141,10 @@ func (c *compiler) path() []string {
 type frame struct {
 	label labeler  // path name leading to this frame.
 	scope ast.Node // *ast.File or *ast.Struct
-	field ast.Decl
+	field *ast.Field
 	// scope   map[ast.Node]bool
 	upCount int32 // 1 for field, 0 for embedding.
 
-	// isComprehensionVar indicates that this scope refers to a for clause
-	// that is part of a comprehension embedded in a struct.
-	isComprehensionVar bool
-
 	aliases map[string]aliasEntry
 }
 
@@ -168,7 +153,6 @@ type aliasEntry struct {
 	srcExpr ast.Expr
 	expr    adt.Expr
 	source  ast.Node
-	feature adt.Feature // For let declarations
 	used    bool
 }
 
@@ -218,8 +202,6 @@ func (c *compiler) lookupAlias(k int, id *ast.Ident) aliasEntry {
 
 	switch {
 	case entry.label != nil:
-		// TODO: allow cyclic references in let expressions once these can be
-		// encoded as a ValueReference.
 		if entry.srcExpr == nil {
 			entry.expr = c.errf(id, "cyclic references in let clause or alias")
 			break
@@ -268,7 +250,6 @@ func (c *compiler) compileFiles(a []*ast.File) *adt.Vertex { // Or value?
 	// Excluded from cross-file resolution are:
 	// - import specs
 	// - aliases
-	// - let declarations
 	// - anything in an anonymous file
 	//
 	for _, f := range a {
@@ -362,10 +343,7 @@ func (c *compiler) resolve(n *ast.Ident) adt.Expr {
 		upCount += c.upCountOffset
 		for p := c.Scope; p != nil; p = p.Parent() {
 			for _, a := range p.Vertex().Arcs {
-				switch {
-				case a.Label.IsLet() && a.Label.IdentString(c.index) == n.Name:
-					label = a.Label
-				case a.Label == label:
+				if a.Label == label {
 					return &adt.FieldReference{
 						Src:     n,
 						UpCount: upCount,
@@ -436,10 +414,7 @@ func (c *compiler) resolve(n *ast.Ident) adt.Expr {
 
 	k := len(c.stack) - 1
 	for ; k >= 0; k-- {
-		if f := c.stack[k]; f.scope == n.Scope {
-			if f.isComprehensionVar {
-				c.refersToForVariable = true
-			}
+		if c.stack[k].scope == n.Scope {
 			break
 		}
 		upCount += c.stack[k].upCount
@@ -463,17 +438,13 @@ func (c *compiler) resolve(n *ast.Ident) adt.Expr {
 	// Local expressions
 	case *ast.LetClause:
 		entry := c.lookupAlias(k, n)
-		if entry.expr == nil {
-			panic("unreachable")
-		}
-		label = entry.feature
 
 		// let x = y
 		return &adt.LetReference{
 			Src:     n,
 			UpCount: upCount,
 			Label:   label,
-			X:       entry.expr, // TODO: remove usage
+			X:       entry.expr,
 		}
 
 	// TODO: handle new-style aliases
@@ -554,7 +525,6 @@ func (c *compiler) markAlias(d ast.Decl) {
 			label:   (*letScope)(x),
 			srcExpr: x.Expr,
 			source:  x,
-			feature: adt.MakeLetLabel(c.index, x.Ident.Name),
 		}
 		c.insertAlias(x.Ident, a)
 
@@ -574,6 +544,14 @@ func (c *compiler) decl(d ast.Decl) adt.Decl {
 			if lab, ok = a.Expr.(ast.Label); !ok {
 				return c.errf(a, "alias expression is not a valid label")
 			}
+
+			switch lab.(type) {
+			case *ast.Ident, *ast.BasicLit, *ast.ListLit:
+				// Even though we won't need the alias, we still register it
+				// for duplicate and failed reference detection.
+			default:
+				c.updateAlias(a.Ident, c.expr(a.Expr))
+			}
 		}
 
 		v := x.Value
@@ -660,31 +638,8 @@ func (c *compiler) decl(d ast.Decl) adt.Decl {
 			}
 		}
 
+	// Handled in addLetDecl.
 	case *ast.LetClause:
-		m := c.stack[len(c.stack)-1].aliases
-		entry := m[x.Ident.Name]
-
-		// A reference to the let should, in principle, be interpreted as a
-		// value reference, not field reference:
-		// - this is syntactically consistent for the use of =
-		// - this is semantically the only valid interpretation
-		// In practice this amounts to the same thing, as let expressions cannot
-		// be addressed from outside their scope. But it will matter once
-		// expressions may refer to a let from within the let.
-
-		savedUses := c.refersToForVariable
-		c.refersToForVariable = false
-		value := c.labeledExpr(x, (*letScope)(x), x.Expr)
-		refsCompVar := c.refersToForVariable
-		c.refersToForVariable = savedUses || refsCompVar
-
-		return &adt.LetField{
-			Src:     x,
-			Label:   entry.feature,
-			IsMulti: refsCompVar,
-			Value:   value,
-		}
-
 	// case: *ast.Alias: // TODO(value alias)
 
 	case *ast.CommentGroup:
@@ -700,7 +655,7 @@ func (c *compiler) decl(d ast.Decl) adt.Decl {
 		}
 
 	case *ast.Comprehension:
-		return c.comprehension(x, false)
+		return c.comprehension(x)
 
 	case *ast.EmbedDecl: // Deprecated
 		return c.expr(x.Expr)
@@ -713,22 +668,15 @@ func (c *compiler) decl(d ast.Decl) adt.Decl {
 
 func (c *compiler) addLetDecl(d ast.Decl) {
 	switch x := d.(type) {
-	case *ast.Field:
-		lab := x.Label
-		if a, ok := lab.(*ast.Alias); ok {
-			if lab, ok = a.Expr.(ast.Label); !ok {
-				// error reported elsewhere
-				return
-			}
-
-			switch lab.(type) {
-			case *ast.Ident, *ast.BasicLit, *ast.ListLit:
-				// Even though we won't need the alias, we still register it
-				// for duplicate and failed reference detection.
-			default:
-				c.updateAlias(a.Ident, c.expr(a.Expr))
-			}
-		}
+	// An alias reference will have an expression that is looked up in the
+	// environment cash.
+	case *ast.LetClause:
+		// Cache the parsed expression. Creating a unique expression for each
+		// reference allows the computation to be shared given that we don't
+		// have fields for expressions. This, in turn, prevents exponential
+		// blowup in x2: x1+x1, x3: x2+x2,  ... patterns.
+		expr := c.labeledExpr(nil, (*letScope)(x), x.Expr)
+		c.updateAlias(x.Ident, expr)
 
 	case *ast.Alias:
 		c.errf(x, "old-style alias no longer supported: use let clause; use cue fix to update.")
@@ -744,7 +692,7 @@ func (c *compiler) elem(n ast.Expr) adt.Elem {
 		}
 
 	case *ast.Comprehension:
-		return c.comprehension(x, true)
+		return c.comprehension(x)
 
 	case ast.Expr:
 		return c.expr(x)
@@ -752,8 +700,10 @@ func (c *compiler) elem(n ast.Expr) adt.Elem {
 	return nil
 }
 
-func (c *compiler) comprehension(x *ast.Comprehension, inList bool) adt.Elem {
-	var a []adt.Yielder
+func (c *compiler) comprehension(x *ast.Comprehension) adt.Elem {
+	var cur adt.Yielder
+	var first adt.Yielder
+	var prev, next *adt.Yielder
 	for _, v := range x.Clauses {
 		switch x := v.(type) {
 		case *ast.ForClause:
@@ -767,42 +717,41 @@ func (c *compiler) comprehension(x *ast.Comprehension, inList bool) adt.Elem {
 				Value:  c.label(x.Value),
 				Src:    c.expr(x.Source),
 			}
-			f := c.pushScope((*forScope)(x), 1, v)
+			cur = y
+			c.pushScope((*forScope)(x), 1, v)
 			defer c.popScope()
-			f.isComprehensionVar = !inList
-			a = append(a, y)
+			next = &y.Dst
 
 		case *ast.IfClause:
 			y := &adt.IfClause{
 				Src:       x,
 				Condition: c.expr(x.Condition),
 			}
-			a = append(a, y)
+			cur = y
+			next = &y.Dst
 
 		case *ast.LetClause:
-			// Check if any references in the expression refer to a for
-			// comprehension.
-			savedUses := c.refersToForVariable
-			c.refersToForVariable = false
-			expr := c.expr(x.Expr)
-			refsCompVar := c.refersToForVariable
-			c.refersToForVariable = savedUses || refsCompVar
-
 			y := &adt.LetClause{
 				Src:   x,
 				Label: c.label(x.Ident),
-				Expr:  expr,
+				Expr:  c.expr(x.Expr),
 			}
-			f := c.pushScope((*letScope)(x), 1, v)
+			cur = y
+			c.pushScope((*letScope)(x), 1, v)
 			defer c.popScope()
-			f.isComprehensionVar = !inList && refsCompVar
-			a = append(a, y)
+			next = &y.Dst
 		}
 
-		if _, ok := a[0].(*adt.LetClause); ok {
-			return c.errf(x,
-				"first comprehension clause must be 'if' or 'for'")
+		if prev != nil {
+			*prev = cur
+		} else {
+			first = cur
+			if _, ok := cur.(*adt.LetClause); ok {
+				return c.errf(x,
+					"first comprehension clause must be 'if' or 'for'")
+			}
 		}
+		prev = next
 	}
 
 	// TODO: make x.Value an *ast.StructLit and this is redundant.
@@ -819,23 +768,27 @@ func (c *compiler) comprehension(x *ast.Comprehension, inList bool) adt.Elem {
 		return y
 	}
 
-	if len(a) == 0 {
+	if prev != nil {
+		*prev = &adt.ValueClause{StructLit: st}
+	} else {
 		return c.errf(x, "comprehension value without clauses")
 	}
 
 	return &adt.Comprehension{
-		Syntax:  x,
-		Clauses: a,
+		Clauses: first,
 		Value:   st,
 	}
 }
 
-func (c *compiler) labeledExpr(f ast.Decl, lab labeler, expr ast.Expr) adt.Expr {
+func (c *compiler) labeledExpr(f *ast.Field, lab labeler, expr ast.Expr) adt.Expr {
 	k := len(c.stack) - 1
 	return c.labeledExprAt(k, f, lab, expr)
 }
 
-func (c *compiler) labeledExprAt(k int, f ast.Decl, lab labeler, expr ast.Expr) adt.Expr {
+func (c *compiler) labeledExprAt(k int, f *ast.Field, lab labeler, expr ast.Expr) adt.Expr {
+	if c.stack[k].field != nil {
+		panic("expected nil field")
+	}
 	saved := c.stack[k]
 
 	c.stack[k].label = lab
diff --git a/vendor/cuelang.org/go/internal/core/convert/go.go b/vendor/cuelang.org/go/internal/core/convert/go.go
index ee00d44c0..b6cc20db2 100644
--- a/vendor/cuelang.org/go/internal/core/convert/go.go
+++ b/vendor/cuelang.org/go/internal/core/convert/go.go
@@ -410,8 +410,6 @@ func convertRec(ctx *adt.OpContext, nilIsTop bool, x interface{}) adt.Value {
 			if env == nil {
 				env = &adt.Environment{}
 			}
-			// There is no closedness or cycle info for Go structs, so we
-			// pass an empty CloseInfo.
 			v.AddStruct(obj, env, adt.CloseInfo{})
 			v.SetValue(ctx, adt.Finalized, &adt.StructMarker{})
 
diff --git a/vendor/cuelang.org/go/internal/core/debug/compact.go b/vendor/cuelang.org/go/internal/core/debug/compact.go
index 87110a25c..c0069f8b5 100644
--- a/vendor/cuelang.org/go/internal/core/debug/compact.go
+++ b/vendor/cuelang.org/go/internal/core/debug/compact.go
@@ -17,6 +17,7 @@
 // Note that the result is not valid CUE, but instead prints the internals
 // of an ADT node in human-readable form. It uses a simple indentation algorithm
 // for improved readability and diffing.
+//
 package debug
 
 import (
@@ -50,23 +51,9 @@ func (w *compactPrinter) node(n adt.Node) {
 				if i > 0 {
 					w.string(",")
 				}
-				if a.Label.IsLet() {
-					w.string("let ")
-					w.label(a.Label)
-					if a.MultiLet {
-						w.string("m")
-					}
-					w.string("=")
-					if c := a.Conjuncts[0]; a.MultiLet {
-						w.node(c.Expr())
-						continue
-					}
-					w.node(a)
-				} else {
-					w.label(a.Label)
-					w.string(":")
-					w.node(a)
-				}
+				w.label(a.Label)
+				w.string(":")
+				w.node(a)
 			}
 			w.string("}")
 
@@ -122,16 +109,6 @@ func (w *compactPrinter) node(n adt.Node) {
 		w.string("?:")
 		w.node(x.Value)
 
-	case *adt.LetField:
-		w.string("let ")
-		s := w.labelString(x.Label)
-		w.string(s)
-		if x.IsMulti {
-			w.string("m")
-		}
-		w.string("=")
-		w.node(x.Value)
-
 	case *adt.BulkOptionalField:
 		w.string("[")
 		w.node(x.Filter)
@@ -325,10 +302,8 @@ func (w *compactPrinter) node(n adt.Node) {
 		}
 
 	case *adt.Comprehension:
-		for _, c := range x.Clauses {
-			w.node(c)
-		}
-		w.node(adt.ToExpr(x.Value))
+		w.node(x.Clauses)
+		w.node(x.Value)
 
 	case *adt.ForClause:
 		w.string("for ")
@@ -338,11 +313,13 @@ func (w *compactPrinter) node(n adt.Node) {
 		w.string(" in ")
 		w.node(x.Src)
 		w.string(" ")
+		w.node(x.Dst)
 
 	case *adt.IfClause:
 		w.string("if ")
 		w.node(x.Condition)
 		w.string(" ")
+		w.node(x.Dst)
 
 	case *adt.LetClause:
 		w.string("let ")
@@ -350,6 +327,7 @@ func (w *compactPrinter) node(n adt.Node) {
 		w.string(" = ")
 		w.node(x.Expr)
 		w.string(" ")
+		w.node(x.Dst)
 
 	case *adt.ValueClause:
 
diff --git a/vendor/cuelang.org/go/internal/core/debug/debug.go b/vendor/cuelang.org/go/internal/core/debug/debug.go
index 59084825b..8394f83ee 100644
--- a/vendor/cuelang.org/go/internal/core/debug/debug.go
+++ b/vendor/cuelang.org/go/internal/core/debug/debug.go
@@ -17,6 +17,7 @@
 // Note that the result is not valid CUE, but instead prints the internals
 // of an ADT node in human-readable form. It uses a simple indentation algorithm
 // for improved readability and diffing.
+//
 package debug
 
 import (
@@ -42,7 +43,6 @@ type Config struct {
 	Raw     bool
 }
 
-// WriteNode writes a string representation of the node to w.
 func WriteNode(w io.Writer, i adt.StringIndexer, n adt.Node, config *Config) {
 	if config == nil {
 		config = &Config{}
@@ -56,10 +56,6 @@ func WriteNode(w io.Writer, i adt.StringIndexer, n adt.Node, config *Config) {
 	}
 }
 
-// NodeString returns a string representation of the given node.
-// The StringIndexer value i is used to translate elements of n to strings.
-// Commonly available implementations of StringIndexer include *adt.OpContext
-// and *runtime.Runtime.
 func NodeString(i adt.StringIndexer, n adt.Node, config *Config) string {
 	b := &strings.Builder{}
 	WriteNode(b, i, n, config)
@@ -94,22 +90,14 @@ func (w *printer) ident(f adt.Feature) {
 
 // TODO: fold into label once :: is no longer supported.
 func (w *printer) labelString(f adt.Feature) string {
-	switch {
-	case f.IsHidden():
+	if f.IsHidden() {
 		ident := f.IdentString(w.index)
 		if pkgName := f.PkgID(w.index); pkgName != "_" {
 			ident = fmt.Sprintf("%s(%s)", ident, pkgName)
 		}
 		return ident
-
-	case f.IsLet():
-		ident := f.RawString(w.index)
-		ident = strings.Replace(ident, "\x00", "#", 1)
-		return ident
-
-	default:
-		return f.SelectorString(w.index)
 	}
+	return f.SelectorString(w.index)
 }
 
 func (w *printer) shortError(errs errors.Error) {
@@ -222,23 +210,9 @@ func (w *printer) node(n adt.Node) {
 
 		for _, a := range x.Arcs {
 			w.string("\n")
-			if a.Label.IsLet() {
-				w.string("let ")
-				w.label(a.Label)
-				if a.MultiLet {
-					w.string("multi")
-				}
-				w.string(" = ")
-				if c := a.Conjuncts[0]; a.MultiLet {
-					w.node(c.Expr())
-					continue
-				}
-				w.node(a)
-			} else {
-				w.label(a.Label)
-				w.string(": ")
-				w.node(a)
-			}
+			w.label(a.Label)
+			w.string(": ")
+			w.node(a)
 		}
 
 		if x.BaseValue == nil {
@@ -311,16 +285,6 @@ func (w *printer) node(n adt.Node) {
 		w.string(" ")
 		w.node(x.Value)
 
-	case *adt.LetField:
-		w.string("let ")
-		s := w.labelString(x.Label)
-		w.string(s)
-		if x.IsMulti {
-			w.string("multi")
-		}
-		w.string(" = ")
-		w.node(x.Value)
-
 	case *adt.BulkOptionalField:
 		w.string("[")
 		w.node(x.Filter)
@@ -423,7 +387,7 @@ func (w *printer) node(n adt.Node) {
 		w.string(openTuple)
 		w.string(strconv.Itoa(int(x.UpCount)))
 		w.string(";let ")
-		w.label(x.Label)
+		w.ident(x.Label)
 		w.string(closeTuple)
 
 	case *adt.SelectorExpr:
@@ -534,10 +498,8 @@ func (w *printer) node(n adt.Node) {
 		w.string(")")
 
 	case *adt.Comprehension:
-		for _, c := range x.Clauses {
-			w.node(c)
-		}
-		w.node(adt.ToExpr(x.Value))
+		w.node(x.Clauses)
+		w.node(x.Value)
 
 	case *adt.ForClause:
 		w.string("for ")
@@ -547,11 +509,13 @@ func (w *printer) node(n adt.Node) {
 		w.string(" in ")
 		w.node(x.Src)
 		w.string(" ")
+		w.node(x.Dst)
 
 	case *adt.IfClause:
 		w.string("if ")
 		w.node(x.Condition)
 		w.string(" ")
+		w.node(x.Dst)
 
 	case *adt.LetClause:
 		w.string("let ")
@@ -559,6 +523,7 @@ func (w *printer) node(n adt.Node) {
 		w.string(" = ")
 		w.node(x.Expr)
 		w.string(" ")
+		w.node(x.Dst)
 
 	case *adt.ValueClause:
 
diff --git a/vendor/cuelang.org/go/internal/core/dep/dep.go b/vendor/cuelang.org/go/internal/core/dep/dep.go
deleted file mode 100644
index c31bd685a..000000000
--- a/vendor/cuelang.org/go/internal/core/dep/dep.go
+++ /dev/null
@@ -1,372 +0,0 @@
-// Copyright 2020 CUE Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// Package dep analyzes dependencies between values.
-package dep
-
-import (
-	"errors"
-
-	"cuelang.org/go/internal/core/adt"
-)
-
-// A Dependency is a reference and the node that reference resolves to.
-type Dependency struct {
-	// Node is the referenced node.
-	Node *adt.Vertex
-
-	// Reference is the expression that referenced the node.
-	Reference adt.Resolver
-
-	top bool
-}
-
-// Import returns the import reference or nil if the reference was within
-// the same package as the visited Vertex.
-func (d *Dependency) Import() *adt.ImportReference {
-	x, _ := d.Reference.(adt.Expr)
-	return importRef(x)
-}
-
-// IsRoot reports whether the dependency is referenced by the root of the
-// original Vertex passed to any of the Visit* functions, and not one of its
-// descendent arcs. This always returns true for Visit().
-func (d *Dependency) IsRoot() bool {
-	return d.top
-}
-
-func (d *Dependency) Path() []adt.Feature {
-	return nil
-}
-
-func importRef(r adt.Expr) *adt.ImportReference {
-	switch x := r.(type) {
-	case *adt.ImportReference:
-		return x
-	case *adt.SelectorExpr:
-		return importRef(x.X)
-	case *adt.IndexExpr:
-		return importRef(x.X)
-	}
-	return nil
-}
-
-// VisitFunc is used for reporting dependencies.
-type VisitFunc func(Dependency) error
-
-// Visit calls f for all vertices referenced by the conjuncts of n without
-// descending into the elements of list or fields of structs. Only references
-// that do not refer to the conjuncts of n itself are reported.
-func Visit(c *adt.OpContext, n *adt.Vertex, f VisitFunc) error {
-	return visit(c, n, f, false, true)
-}
-
-// VisitAll calls f for all vertices referenced by the conjuncts of n including
-// those of descendant fields and elements. Only references that do not refer to
-// the conjuncts of n itself are reported.
-func VisitAll(c *adt.OpContext, n *adt.Vertex, f VisitFunc) error {
-	return visit(c, n, f, true, true)
-}
-
-// VisitFields calls f for n and all its descendent arcs that have a conjunct
-// that originates from a conjunct in n. Only the conjuncts of n that ended up
-// as a conjunct in an actual field are visited and they are visited for each
-// field in which the occurs.
-func VisitFields(c *adt.OpContext, n *adt.Vertex, f VisitFunc) error {
-	m := marked{}
-
-	m.markExpr(n)
-
-	dynamic(c, n, f, m, true)
-	return nil
-}
-
-var empty *adt.Vertex
-
-func init() {
-	// TODO: Consider setting a non-nil BaseValue.
-	empty = &adt.Vertex{}
-	empty.UpdateStatus(adt.Finalized)
-}
-
-func visit(c *adt.OpContext, n *adt.Vertex, f VisitFunc, all, top bool) (err error) {
-	if c == nil {
-		panic("nil context")
-	}
-	v := visitor{
-		ctxt:  c,
-		visit: f,
-		node:  n,
-		all:   all,
-		top:   top,
-	}
-
-	defer func() {
-		switch x := recover(); x {
-		case nil:
-		case aborted:
-			err = v.err
-		default:
-			panic(x)
-		}
-	}()
-
-	for _, x := range n.Conjuncts {
-		v.markExpr(x.Env, x.Elem())
-	}
-
-	return nil
-}
-
-var aborted = errors.New("aborted")
-
-type visitor struct {
-	ctxt  *adt.OpContext
-	visit VisitFunc
-	node  *adt.Vertex
-	err   error
-	all   bool
-	top   bool
-}
-
-// TODO: factor out the below logic as either a low-level dependency analyzer or
-// some walk functionality.
-
-// markExpr visits all nodes in an expression to mark dependencies.
-func (c *visitor) markExpr(env *adt.Environment, expr adt.Elem) {
-	switch x := expr.(type) {
-	case nil:
-	case adt.Resolver:
-		c.markResolver(env, x)
-
-	case *adt.BinaryExpr:
-		c.markExpr(env, x.X)
-		c.markExpr(env, x.Y)
-
-	case *adt.UnaryExpr:
-		c.markExpr(env, x.X)
-
-	case *adt.Interpolation:
-		for i := 1; i < len(x.Parts); i += 2 {
-			c.markExpr(env, x.Parts[i])
-		}
-
-	case *adt.BoundExpr:
-		c.markExpr(env, x.Expr)
-
-	case *adt.CallExpr:
-		c.markExpr(env, x.Fun)
-		saved := c.all
-		c.all = true
-		for _, a := range x.Args {
-			c.markExpr(env, a)
-		}
-		c.all = saved
-
-	case *adt.DisjunctionExpr:
-		for _, d := range x.Values {
-			c.markExpr(env, d.Val)
-		}
-
-	case *adt.SliceExpr:
-		c.markExpr(env, x.X)
-		c.markExpr(env, x.Lo)
-		c.markExpr(env, x.Hi)
-		c.markExpr(env, x.Stride)
-
-	case *adt.ListLit:
-		env := &adt.Environment{Up: env, Vertex: empty}
-		for _, e := range x.Elems {
-			switch x := e.(type) {
-			case *adt.Comprehension:
-				c.markComprehension(env, x)
-
-			case adt.Expr:
-				c.markSubExpr(env, x)
-
-			case *adt.Ellipsis:
-				if x.Value != nil {
-					c.markSubExpr(env, x.Value)
-				}
-			}
-		}
-
-	case *adt.StructLit:
-		env := &adt.Environment{Up: env, Vertex: empty}
-		for _, e := range x.Decls {
-			c.markDecl(env, e)
-		}
-
-	case *adt.Comprehension:
-		c.markComprehension(env, x)
-	}
-}
-
-// markResolve resolves dependencies.
-func (c *visitor) markResolver(env *adt.Environment, r adt.Resolver) {
-	// Note: it is okay to pass an empty CloseInfo{} here as we assume that
-	// all nodes are finalized already and we need neither closedness nor cycle
-	// checks.
-	if ref, _ := c.ctxt.Resolve(adt.MakeConjunct(env, r, adt.CloseInfo{}), r); ref != nil {
-		// If ref is within a let, we only care about dependencies referred to
-		// by internal expressions. The let expression itself is not considered
-		// a dependency and is considered part of the referring expression.
-		if hasLetParent(ref) {
-			// It is okay to use the Environment recorded in the arc, as
-			// lets that may vary per Environment already have a separate arc
-			// associated with them (see Vertex.MultiLet).
-			for _, x := range ref.Conjuncts {
-				c.markExpr(x.Env, x.Expr())
-			}
-			return
-		}
-
-		if ref != c.node && ref != empty {
-			d := Dependency{
-				Node:      ref,
-				Reference: r,
-				top:       c.top,
-			}
-			if err := c.visit(d); err != nil {
-				c.err = err
-				panic(aborted)
-			}
-		}
-
-		return
-	}
-
-	// It is possible that a reference cannot be resolved because it is
-	// incomplete. In this case, we should check whether subexpressions of the
-	// reference can be resolved to mark those dependencies. For instance,
-	// prefix paths of selectors and the value or index of an index experssion
-	// may independently resolve to a valid dependency.
-
-	switch x := r.(type) {
-	case *adt.NodeLink:
-		panic("unreachable")
-
-	case *adt.IndexExpr:
-		c.markExpr(env, x.X)
-		c.markExpr(env, x.Index)
-
-	case *adt.SelectorExpr:
-		c.markExpr(env, x.X)
-	}
-}
-
-// TODO(perf): make this available as a property of vertices to avoid doing
-// these dynamic lookups.
-func hasLetParent(v *adt.Vertex) bool {
-	for ; v != nil; v = v.Parent {
-		if v.Label.IsLet() {
-			return true
-		}
-	}
-	return false
-}
-
-func (c *visitor) markSubExpr(env *adt.Environment, x adt.Expr) {
-	if c.all {
-		saved := c.top
-		c.top = false
-		c.markExpr(env, x)
-		c.top = saved
-	}
-}
-
-func (c *visitor) markDecl(env *adt.Environment, d adt.Decl) {
-	switch x := d.(type) {
-	case *adt.Field:
-		c.markSubExpr(env, x.Value)
-
-	case *adt.OptionalField:
-		// when dynamic, only continue if there is evidence of
-		// the field in the parallel actual evaluation.
-		c.markSubExpr(env, x.Value)
-
-	case *adt.BulkOptionalField:
-		c.markExpr(env, x.Filter)
-		// when dynamic, only continue if there is evidence of
-		// the field in the parallel actual evaluation.
-		c.markSubExpr(env, x.Value)
-
-	case *adt.DynamicField:
-		c.markExpr(env, x.Key)
-		// when dynamic, only continue if there is evidence of
-		// a matching field in the parallel actual evaluation.
-		c.markSubExpr(env, x.Value)
-
-	case *adt.Comprehension:
-		c.markComprehension(env, x)
-
-	case adt.Expr:
-		c.markExpr(env, x)
-
-	case *adt.Ellipsis:
-		if x.Value != nil {
-			c.markSubExpr(env, x.Value)
-		}
-	}
-}
-
-func (c *visitor) markComprehension(env *adt.Environment, y *adt.Comprehension) {
-	env = c.markClauses(env, y.Clauses)
-
-	// Use "live" environments if we have them. This is important if
-	// dependencies are computed on a partially evaluated value where a pushed
-	// down comprehension is defined outside the root of the dependency
-	// analysis. For instance, when analyzing dependencies at path a.b in:
-	//
-	//  a: {
-	//      for value in { test: 1 } {
-	//          b: bar: value
-	//      }
-	//  }
-	//
-	if envs := y.Envs(); len(envs) > 0 {
-		// We use the Environment to get access to the parent chain. It
-		// suffices to take any Environment (in this case the first), as all
-		// will have the same parent chain.
-		env = envs[0]
-	}
-	for i := y.Nest(); i > 0; i-- {
-		env = &adt.Environment{Up: env, Vertex: empty}
-	}
-	c.markExpr(env, adt.ToExpr(y.Value))
-}
-
-func (c *visitor) markClauses(env *adt.Environment, a []adt.Yielder) *adt.Environment {
-	for _, y := range a {
-		switch x := y.(type) {
-		case *adt.ForClause:
-			c.markExpr(env, x.Src)
-			env = &adt.Environment{Up: env, Vertex: empty}
-			// In dynamic mode, iterate over all actual value and
-			// evaluate.
-
-		case *adt.LetClause:
-			c.markExpr(env, x.Expr)
-			env = &adt.Environment{Up: env, Vertex: empty}
-
-		case *adt.IfClause:
-			c.markExpr(env, x.Condition)
-			// In dynamic mode, only continue if condition is true.
-
-		case *adt.ValueClause:
-			env = &adt.Environment{Up: env, Vertex: empty}
-		}
-	}
-	return env
-}
diff --git a/vendor/cuelang.org/go/internal/core/dep/mixed.go b/vendor/cuelang.org/go/internal/core/dep/mixed.go
deleted file mode 100644
index aef48d6f8..000000000
--- a/vendor/cuelang.org/go/internal/core/dep/mixed.go
+++ /dev/null
@@ -1,137 +0,0 @@
-// Copyright 2020 CUE Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package dep
-
-import (
-	"fmt"
-
-	"cuelang.org/go/internal/core/adt"
-)
-
-// dynamic visits conjuncts of structs that are defined by the root for all
-// of its fields, recursively.
-//
-// The current algorithm visits all known conjuncts and descends into the
-// evaluated Vertex. A more correct and more performant algorithm would be to
-// descend into the conjuncts and evaluate the necessary values, like fields
-// and comprehension sources.
-func dynamic(c *adt.OpContext, n *adt.Vertex, f VisitFunc, m marked, top bool) {
-	found := false
-	for _, c := range n.Conjuncts {
-		if m[c.Expr()] {
-			found = true
-			break
-		}
-	}
-
-	if !found {
-		return
-	}
-
-	if visit(c, n, f, false, top) != nil {
-		return
-	}
-
-	for _, a := range n.Arcs {
-		if !a.IsDefined(c) || a.Label.IsLet() {
-			continue
-		}
-		dynamic(c, a, f, m, false)
-	}
-}
-
-type marked map[adt.Expr]bool
-
-// TODO: factor out the below logic as either a low-level dependency analyzer or
-// some walk functionality.
-
-// markExpr visits all nodes in an expression to mark dependencies.
-func (m marked) markExpr(x adt.Expr) {
-	m[x] = true
-
-	switch x := x.(type) {
-	default:
-
-	case nil:
-	case *adt.Vertex:
-		for _, c := range x.Conjuncts {
-			m.markExpr(c.Expr())
-		}
-
-	case *adt.BinaryExpr:
-		if x.Op == adt.AndOp {
-			m.markExpr(x.X)
-			m.markExpr(x.Y)
-		}
-
-	case *adt.StructLit:
-		for _, e := range x.Decls {
-			switch x := e.(type) {
-			case *adt.Field:
-				m.markExpr(x.Value)
-
-			case *adt.OptionalField:
-				m.markExpr(x.Value)
-
-			case *adt.BulkOptionalField:
-				m.markExpr(x.Value)
-
-			case *adt.LetField:
-				m.markExpr(x.Value)
-
-			case *adt.DynamicField:
-				m.markExpr(x.Value)
-
-			case *adt.Ellipsis:
-				m.markExpr(x.Value)
-
-			case adt.Expr:
-				m.markExpr(x)
-
-			case *adt.Comprehension:
-				m.markComprehension(x)
-
-			default:
-				panic(fmt.Sprintf("unreachable %T", x))
-			}
-		}
-
-	case *adt.ListLit:
-		for _, e := range x.Elems {
-			switch x := e.(type) {
-			case adt.Expr:
-				m.markExpr(x)
-
-			case *adt.Comprehension:
-				m.markComprehension(x)
-
-			case *adt.Ellipsis:
-				m.markExpr(x.Value)
-
-			default:
-				panic(fmt.Sprintf("unreachable %T", x))
-			}
-		}
-
-	case *adt.DisjunctionExpr:
-		for _, d := range x.Values {
-			m.markExpr(d.Val)
-		}
-	}
-}
-
-func (m marked) markComprehension(y *adt.Comprehension) {
-	m.markExpr(adt.ToExpr(y.Value))
-}
diff --git a/vendor/cuelang.org/go/internal/core/eval/eval.go b/vendor/cuelang.org/go/internal/core/eval/eval.go
index 5e26fc637..07bc3ac4f 100644
--- a/vendor/cuelang.org/go/internal/core/eval/eval.go
+++ b/vendor/cuelang.org/go/internal/core/eval/eval.go
@@ -15,7 +15,6 @@
 package eval
 
 import (
-	"cuelang.org/go/cue/stats"
 	"cuelang.org/go/internal/core/adt"
 	"cuelang.org/go/internal/core/debug"
 )
@@ -44,7 +43,7 @@ func (e *Unifier) Unify(ctx *adt.OpContext, v *adt.Vertex, state adt.VertexStatu
 	e.e.Unify(v, state)
 }
 
-func (e *Unifier) Stats() *stats.Counts {
+func (e *Unifier) Stats() *adt.Stats {
 	return e.e.Stats()
 }
 
diff --git a/vendor/cuelang.org/go/internal/core/export/adt.go b/vendor/cuelang.org/go/internal/core/export/adt.go
index 5f5ee13ee..8e860d609 100644
--- a/vendor/cuelang.org/go/internal/core/export/adt.go
+++ b/vendor/cuelang.org/go/internal/core/export/adt.go
@@ -34,16 +34,15 @@ func (e *exporter) ident(x adt.Feature) *ast.Ident {
 	return ast.NewIdent(s)
 }
 
-func (e *exporter) adt(env *adt.Environment, expr adt.Elem) ast.Expr {
+func (e *exporter) adt(expr adt.Elem, conjuncts []adt.Conjunct) ast.Expr {
 	switch x := expr.(type) {
 	case adt.Value:
-		return e.expr(env, x)
+		return e.expr(x)
 
 	case *adt.ListLit:
-		env := &adt.Environment{Up: env, Vertex: e.node()}
 		a := []ast.Expr{}
 		for _, x := range x.Elems {
-			a = append(a, e.elem(env, x))
+			a = append(a, e.elem(x))
 		}
 		return ast.NewList(a...)
 
@@ -54,10 +53,6 @@ func (e *exporter) adt(env *adt.Environment, expr adt.Elem) ast.Expr {
 		// s := e.frame(0).scope
 
 		s := &ast.StructLit{}
-		// TODO: ensure e.node() is set in more cases. Right now it is not
-		// always set in mergeValues, even in cases where it could be. Better
-		// to be conservative for now, though.
-		env := &adt.Environment{Up: env, Vertex: e.node()}
 
 		for _, d := range x.Decls {
 			var a *ast.Alias
@@ -70,19 +65,7 @@ func (e *exporter) adt(env *adt.Environment, expr adt.Elem) ast.Expr {
 					e.valueAlias[alias] = a
 				}
 			}
-			decl := e.decl(env, d)
-
-			// decl may be nil if it represents a let. Lets are added later, and
-			// only when they are still used.
-			if decl == nil {
-				continue
-			}
-
-			if e.cfg.ShowDocs {
-				ast.SetComments(decl, filterDocs(ast.Comments(d.Source())))
-			}
-			// TODO: use e.copyMeta for positions, but only when the original
-			// source is available.
+			decl := e.decl(d)
 
 			if a != nil {
 				if f, ok := decl.(*ast.Field); ok {
@@ -96,14 +79,46 @@ func (e *exporter) adt(env *adt.Environment, expr adt.Elem) ast.Expr {
 
 		return s
 
-	// TODO: why does LabelReference not implement resolve?
+	case *adt.FieldReference:
+		f := e.frame(x.UpCount)
+		entry := f.fields[x.Label]
+
+		name := x.Label.IdentString(e.ctx)
+		switch {
+		case entry.alias != "":
+			name = entry.alias
+
+		case !ast.IsValidIdent(name):
+			name = "X"
+			if x.Src != nil {
+				name = x.Src.Name
+			}
+			name = e.uniqueAlias(name)
+			entry.alias = name
+		}
+
+		ident := ast.NewIdent(name)
+		entry.references = append(entry.references, ident)
+
+		if f.fields != nil {
+			f.fields[x.Label] = entry
+		}
+
+		return ident
+
+	case *adt.ValueReference:
+		name := x.Label.IdentString(e.ctx)
+		if a, ok := x.Src.Node.(*ast.Alias); ok { // Should always pass
+			if b, ok := e.valueAlias[a]; ok {
+				name = b.Ident.Name
+			}
+		}
+		ident := ast.NewIdent(name)
+		return ident
+
 	case *adt.LabelReference:
 		// get potential label from Source. Otherwise use X.
-		v, ok := e.ctx.Evaluate(env, x)
 		f := e.frame(x.UpCount)
-		if ok && (adt.IsConcrete(v) || f.field == nil) {
-			return e.value(v)
-		}
 		if f.field == nil {
 			// This can happen when the LabelReference is evaluated outside of
 			// normal evaluation, that is, if a pattern constraint or
@@ -132,22 +147,65 @@ func (e *exporter) adt(env *adt.Environment, expr adt.Elem) ast.Expr {
 		ident.Node = f.labelExpr
 		return ident
 
-	case adt.Resolver:
-		return e.resolve(env, x)
+	case *adt.DynamicReference:
+		// get potential label from Source. Otherwise use X.
+		name := "X"
+		f := e.frame(x.UpCount)
+		if d := f.field; d != nil {
+			if x.Src != nil {
+				name = x.Src.Name
+			}
+			name = e.getFieldAlias(d, name)
+		}
+		ident := ast.NewIdent(name)
+		ident.Scope = f.field
+		ident.Node = f.field
+		return ident
+
+	case *adt.ImportReference:
+		importPath := x.ImportPath.StringValue(e.index)
+		spec := ast.NewImport(nil, importPath)
+
+		info, _ := astutil.ParseImportSpec(spec)
+		name := info.PkgName
+		if x.Label != 0 {
+			name = x.Label.StringValue(e.index)
+			if name != info.PkgName {
+				spec.Name = ast.NewIdent(name)
+			}
+		}
+		ident := ast.NewIdent(name)
+		ident.Node = spec
+		return ident
+
+	case *adt.LetReference:
+		return e.resolveLet(x)
+
+	case *adt.SelectorExpr:
+		return &ast.SelectorExpr{
+			X:   e.expr(x.X),
+			Sel: e.stringLabel(x.Sel),
+		}
+
+	case *adt.IndexExpr:
+		return &ast.IndexExpr{
+			X:     e.expr(x.X),
+			Index: e.expr(x.Index),
+		}
 
 	case *adt.SliceExpr:
 		var lo, hi ast.Expr
 		if x.Lo != nil {
-			lo = e.innerExpr(env, x.Lo)
+			lo = e.expr(x.Lo)
 		}
 		if x.Hi != nil {
-			hi = e.innerExpr(env, x.Hi)
+			hi = e.expr(x.Hi)
 		}
 		// TODO: Stride not yet? implemented.
 		// if x.Stride != nil {
-		// 	stride = e.innerExpr(env, x.Stride)
+		// 	stride = e.expr(x.Stride)
 		// }
-		return &ast.SliceExpr{X: e.innerExpr(env, x.X), Low: lo, High: hi}
+		return &ast.SliceExpr{X: e.expr(x.X), Low: lo, High: hi}
 
 	case *adt.Interpolation:
 		var (
@@ -189,7 +247,7 @@ func (e *exporter) adt(env *adt.Environment, expr adt.Elem) ast.Expr {
 		suffix := `\(`
 		for i, elem := range x.Parts {
 			if i%2 == 1 {
-				t.Elts = append(t.Elts, e.innerExpr(env, elem))
+				t.Elts = append(t.Elts, e.expr(elem))
 			} else {
 				// b := strings.Builder{}
 				buf := []byte(prefix)
@@ -219,39 +277,39 @@ func (e *exporter) adt(env *adt.Environment, expr adt.Elem) ast.Expr {
 	case *adt.BoundExpr:
 		return &ast.UnaryExpr{
 			Op: x.Op.Token(),
-			X:  e.innerExpr(env, x.Expr),
+			X:  e.expr(x.Expr),
 		}
 
 	case *adt.UnaryExpr:
 		return &ast.UnaryExpr{
 			Op: x.Op.Token(),
-			X:  e.innerExpr(env, x.X),
+			X:  e.expr(x.X),
 		}
 
 	case *adt.BinaryExpr:
 		return &ast.BinaryExpr{
 			Op: x.Op.Token(),
-			X:  e.innerExpr(env, x.X),
-			Y:  e.innerExpr(env, x.Y),
+			X:  e.expr(x.X),
+			Y:  e.expr(x.Y),
 		}
 
 	case *adt.CallExpr:
 		a := []ast.Expr{}
 		for _, arg := range x.Args {
-			v := e.innerExpr(env, arg)
+			v := e.expr(arg)
 			if v == nil {
-				e.innerExpr(env, arg)
+				e.expr(arg)
 				panic("")
 			}
 			a = append(a, v)
 		}
-		fun := e.innerExpr(env, x.Fun)
+		fun := e.expr(x.Fun)
 		return &ast.CallExpr{Fun: fun, Args: a}
 
 	case *adt.DisjunctionExpr:
 		a := []ast.Expr{}
 		for _, d := range x.Values {
-			v := e.expr(env, d.Val)
+			v := e.expr(d.Val)
 			if d.Default {
 				v = &ast.UnaryExpr{Op: token.MUL, X: v}
 			}
@@ -259,161 +317,15 @@ func (e *exporter) adt(env *adt.Environment, expr adt.Elem) ast.Expr {
 		}
 		return ast.NewBinExpr(token.OR, a...)
 
-	case *adt.Comprehension:
-		if !x.DidResolve() {
-			return dummyTop
-		}
-		for _, c := range x.Clauses {
-			switch c.(type) {
-			case *adt.ForClause:
-				env = &adt.Environment{Up: env, Vertex: empty}
-			case *adt.IfClause:
-			case *adt.LetClause:
-				env = &adt.Environment{Up: env, Vertex: empty}
-			case *adt.ValueClause:
-				// Can occur in nested comprehenions.
-				env = &adt.Environment{Up: env, Vertex: empty}
-			default:
-				panic("unreachable")
-			}
-		}
-		return e.adt(env, adt.ToExpr(x.Value))
-
 	default:
 		panic(fmt.Sprintf("unknown field %T", x))
 	}
 }
 
-var dummyTop = &ast.Ident{Name: "_"}
-
-func (e *exporter) resolve(env *adt.Environment, r adt.Resolver) ast.Expr {
-	if c := e.pivotter; c != nil {
-		if alt := c.refExpr(r); alt != nil {
-			return alt
-		}
-	}
-
-	switch x := r.(type) {
-	case *adt.FieldReference:
-		ident, _ := e.newIdentForField(x.Src, x.Label, x.UpCount)
-		return ident
-
-	case *adt.ValueReference:
-		name := x.Label.IdentString(e.ctx)
-		if a, ok := x.Src.Node.(*ast.Alias); ok { // Should always pass
-			if b, ok := e.valueAlias[a]; ok {
-				name = b.Ident.Name
-			}
-		}
-		ident := ast.NewIdent(name)
-		return ident
-
-	case *adt.DynamicReference:
-		// TODO(unshadow): ensure we correctly unshadow newly visible fields.
-		//   before uncommenting this.
-		// if v := x.EvaluateLabel(e.ctx, env); v != 0 {
-		// 	str := v.StringValue(e.ctx)
-		// 	if ast.IsValidIdent(str) {
-		// 		label := e.ctx.StringLabel(str)
-		// 		ident, ok := e.newIdentForField(x.Src, label, x.UpCount)
-		// 		if ok {
-		// 			return ident
-		// 		}
-		// 	}
-		// }
-
-		name := "X"
-		if x.Src != nil {
-			name = x.Src.Name
-		}
-		var f *ast.Field
-		for i := len(e.stack) - 1; i >= 0; i-- {
-			for _, entry := range e.stack[i].dynamicFields {
-				if entry.alias == name {
-					f = entry.field
-				}
-			}
-		}
-
-		if f != nil {
-			name = e.getFieldAlias(f, name)
-		}
-
-		ident := ast.NewIdent(name)
-		ident.Scope = f
-		ident.Node = f
-		return ident
-
-	case *adt.ImportReference:
-		importPath := x.ImportPath.StringValue(e.index)
-		spec := ast.NewImport(nil, importPath)
-
-		info, _ := astutil.ParseImportSpec(spec)
-		name := info.PkgName
-		if x.Label != 0 {
-			name = x.Label.StringValue(e.index)
-			if name != info.PkgName {
-				spec.Name = ast.NewIdent(name)
-			}
-		}
-		ident := ast.NewIdent(name)
-		ident.Node = spec
-		return ident
-
-	case *adt.LetReference:
-		return e.resolveLet(env, x)
-
-	case *adt.SelectorExpr:
-		return &ast.SelectorExpr{
-			X:   e.innerExpr(env, x.X),
-			Sel: e.stringLabel(x.Sel),
-		}
-
-	case *adt.IndexExpr:
-		return &ast.IndexExpr{
-			X:     e.innerExpr(env, x.X),
-			Index: e.innerExpr(env, x.Index),
-		}
-	}
-	panic("unreachable")
-}
-
-func (e *exporter) newIdentForField(
-	orig *ast.Ident,
-	label adt.Feature,
-	upCount int32) (ident *ast.Ident, ok bool) {
-	f := e.frame(upCount)
-	entry := f.fields[label]
-
-	name := e.identString(label)
-	switch {
-	case entry.alias != "":
-		name = entry.alias
-
-	case !ast.IsValidIdent(name):
-		name = "X"
-		if orig != nil {
-			name = orig.Name
-		}
-		name = e.uniqueAlias(name)
-		entry.alias = name
-	}
-
-	ident = ast.NewIdent(name)
-	entry.references = append(entry.references, ident)
-
-	if f.fields != nil {
-		f.fields[label] = entry
-		ok = true
-	}
-
-	return ident, ok
-}
-
-func (e *exporter) decl(env *adt.Environment, d adt.Decl) ast.Decl {
+func (e *exporter) decl(d adt.Decl) ast.Decl {
 	switch x := d.(type) {
 	case adt.Elem:
-		return e.elem(env, x)
+		return e.elem(x)
 
 	case *adt.Field:
 		e.setDocs(x)
@@ -421,11 +333,15 @@ func (e *exporter) decl(env *adt.Environment, d adt.Decl) ast.Decl {
 			Label: e.stringLabel(x.Label),
 		}
 
-		e.setField(x.Label, f)
+		frame := e.frame(0)
+		entry := frame.fields[x.Label]
+		entry.field = f
+		entry.node = f.Value
+		frame.fields[x.Label] = entry
 
-		f.Value = e.expr(env, x.Value)
-		f.Attrs = extractFieldAttrs(nil, x)
+		f.Value = e.expr(x.Value)
 
+		// extractDocs(nil)
 		return f
 
 	case *adt.OptionalField:
@@ -435,23 +351,23 @@ func (e *exporter) decl(env *adt.Environment, d adt.Decl) ast.Decl {
 			Optional: token.NoSpace.Pos(),
 		}
 
-		e.setField(x.Label, f)
+		frame := e.frame(0)
+		entry := frame.fields[x.Label]
+		entry.field = f
+		entry.node = f.Value
+		frame.fields[x.Label] = entry
 
-		f.Value = e.expr(env, x.Value)
-		f.Attrs = extractFieldAttrs(nil, x)
+		f.Value = e.expr(x.Value)
 
+		// extractDocs(nil)
 		return f
 
-	case *adt.LetField:
-		// Handled elsewhere
-		return nil
-
 	case *adt.BulkOptionalField:
 		e.setDocs(x)
 		// set bulk in frame.
 		frame := e.frame(0)
 
-		expr := e.innerExpr(env, x.Filter)
+		expr := e.expr(x.Filter)
 		frame.labelExpr = expr // see astutil.Resolve.
 
 		if x.Label != 0 {
@@ -463,58 +379,26 @@ func (e *exporter) decl(env *adt.Environment, d adt.Decl) ast.Decl {
 
 		frame.field = f
 
-		if alias := aliasFromLabel(x.Src); alias != "" {
-			frame.dynamicFields = append(frame.dynamicFields, &entry{
-				alias: alias,
-				field: f,
-			})
-		}
-
-		f.Value = e.expr(env, x.Value)
-		f.Attrs = extractFieldAttrs(nil, x)
+		f.Value = e.expr(x.Value)
 
 		return f
 
 	case *adt.DynamicField:
 		e.setDocs(x)
-		srcKey := x.Key
-
-		f := &ast.Field{}
-
-		v, _ := e.ctx.Evaluate(env, x.Key)
-
-		switch s, ok := v.(*adt.String); {
-		// TODO(unshadow): allow once unshadowing algorithm is fixed.
-		// case ok && ast.IsValidIdent(s.Str):
-		// 	label := e.ctx.StringLabel(s.Str)
-		// 	f.Label = ast.NewIdent(s.Str)
-		// 	e.setField(label, f)
-
-		case ok:
-			srcKey = s
-
-			fallthrough
-
-		default:
-			key := e.innerExpr(env, srcKey)
-			switch key.(type) {
-			case *ast.Interpolation, *ast.BasicLit:
-			default:
-				key = &ast.ParenExpr{X: key}
-			}
-			f.Label = key.(ast.Label)
+		key := e.expr(x.Key)
+		if _, ok := key.(*ast.Interpolation); !ok {
+			key = &ast.ParenExpr{X: key}
+		}
+		f := &ast.Field{
+			Label: key.(ast.Label),
 		}
-
-		alias := aliasFromLabel(x.Src)
 
 		frame := e.frame(0)
-		frame.dynamicFields = append(frame.dynamicFields, &entry{
-			alias: alias,
-			field: f,
-		})
+		frame.field = f
+		frame.labelExpr = key
+		// extractDocs(nil)
 
-		f.Value = e.expr(env, x.Value)
-		f.Attrs = extractFieldAttrs(nil, x)
+		f.Value = e.expr(x.Value)
 
 		return f
 
@@ -523,82 +407,44 @@ func (e *exporter) decl(env *adt.Environment, d adt.Decl) ast.Decl {
 	}
 }
 
-func (e *exporter) copyMeta(dst, src ast.Node) {
-	if e.cfg.ShowDocs {
-		ast.SetComments(dst, filterDocs(ast.Comments(src)))
-	}
-	astutil.CopyPosition(dst, src)
-}
-
-func filterDocs(a []*ast.CommentGroup) (out []*ast.CommentGroup) {
-	out = append(out, a...)
-	k := 0
-	for _, c := range a {
-		if !c.Doc {
-			continue
-		}
-		out[k] = c
-		k++
-	}
-	out = out[:k]
-	return out
-}
-
-func (e *exporter) setField(label adt.Feature, f *ast.Field) {
-	frame := e.frame(0)
-	entry := frame.fields[label]
-	entry.field = f
-	entry.node = f.Value
-	// This can happen when evaluation is "pivoted".
-	if frame.fields != nil {
-		frame.fields[label] = entry
-	}
-}
-
-func aliasFromLabel(src *ast.Field) string {
-	if src != nil {
-		if a, ok := src.Label.(*ast.Alias); ok {
-			return a.Ident.Name
-		}
-	}
-	return ""
-}
-
-func (e *exporter) elem(env *adt.Environment, d adt.Elem) ast.Expr {
+func (e *exporter) elem(d adt.Elem) ast.Expr {
 
 	switch x := d.(type) {
 	case adt.Expr:
-		return e.expr(env, x)
+		return e.expr(x)
 
 	case *adt.Ellipsis:
 		t := &ast.Ellipsis{}
 		if x.Value != nil {
-			t.Type = e.expr(env, x.Value)
+			t.Type = e.expr(x.Value)
 		}
 		return t
 
 	case *adt.Comprehension:
-		return e.comprehension(env, x)
+		return e.comprehension(x)
 
 	default:
 		panic(fmt.Sprintf("unknown field %T", x))
 	}
 }
 
-func (e *exporter) comprehension(env *adt.Environment, comp *adt.Comprehension) *ast.Comprehension {
+func (e *exporter) comprehension(comp *adt.Comprehension) *ast.Comprehension {
 	c := &ast.Comprehension{}
 
-	for _, y := range comp.Clauses {
+	y := comp.Clauses
+
+loop:
+	for {
 		switch x := y.(type) {
 		case *adt.ForClause:
-			env = &adt.Environment{Up: env, Vertex: empty}
 			value := e.ident(x.Value)
-			src := e.innerExpr(env, x.Src)
-			clause := &ast.ForClause{Value: value, Source: src}
-			e.copyMeta(clause, x.Syntax)
+			clause := &ast.ForClause{
+				Value:  value,
+				Source: e.expr(x.Src),
+			}
 			c.Clauses = append(c.Clauses, clause)
 
-			_, saved := e.pushFrame(empty, nil)
+			_, saved := e.pushFrame(nil)
 			defer e.popFrame(saved)
 
 			if x.Key != adt.InvalidLabel ||
@@ -609,44 +455,36 @@ func (e *exporter) comprehension(env *adt.Environment, comp *adt.Comprehension)
 			}
 			e.addField(x.Value, nil, clause)
 
+			y = x.Dst
+
 		case *adt.IfClause:
-			cond := e.innerExpr(env, x.Condition)
-			clause := &ast.IfClause{Condition: cond}
-			e.copyMeta(clause, x.Src)
+			clause := &ast.IfClause{Condition: e.expr(x.Condition)}
 			c.Clauses = append(c.Clauses, clause)
+			y = x.Dst
 
 		case *adt.LetClause:
-			env = &adt.Environment{Up: env, Vertex: empty}
-			expr := e.innerExpr(env, x.Expr)
 			clause := &ast.LetClause{
 				Ident: e.ident(x.Label),
-				Expr:  expr,
+				Expr:  e.expr(x.Expr),
 			}
-			e.copyMeta(clause, x.Src)
 			c.Clauses = append(c.Clauses, clause)
 
-			_, saved := e.pushFrame(empty, nil)
+			_, saved := e.pushFrame(nil)
 			defer e.popFrame(saved)
 
 			e.addField(x.Label, nil, clause)
 
+			y = x.Dst
+
 		case *adt.ValueClause:
-			// Can occur in nested comprehenions.
-			env = &adt.Environment{Up: env, Vertex: empty}
+			break loop
 
 		default:
 			panic(fmt.Sprintf("unknown field %T", x))
 		}
 	}
-	e.copyMeta(c, comp.Syntax)
-
-	// If this is an "unwrapped" comprehension, we need to also
-	// account for the curly braces of the original comprehension.
-	if comp.Nest() > 0 {
-		env = &adt.Environment{Up: env, Vertex: empty}
-	}
 
-	v := e.expr(env, adt.ToExpr(comp.Value))
+	v := e.expr(comp.Value)
 	if _, ok := v.(*ast.StructLit); !ok {
 		v = ast.NewStruct(ast.Embed(v))
 	}
diff --git a/vendor/cuelang.org/go/internal/core/export/bounds.go b/vendor/cuelang.org/go/internal/core/export/bounds.go
index 325f0aae8..71788a9d9 100644
--- a/vendor/cuelang.org/go/internal/core/export/bounds.go
+++ b/vendor/cuelang.org/go/internal/core/export/bounds.go
@@ -131,10 +131,10 @@ func (s *boundSimplifier) expr(ctx *adt.OpContext) (e ast.Expr) {
 	}
 
 	if s.min != nil {
-		e = wrapBin(e, s.e.expr(nil, s.min), adt.AndOp)
+		e = wrapBin(e, s.e.expr(s.min), adt.AndOp)
 	}
 	if s.max != nil {
-		e = wrapBin(e, s.e.expr(nil, s.max), adt.AndOp)
+		e = wrapBin(e, s.e.expr(s.max), adt.AndOp)
 	}
 	return e
 }
diff --git a/vendor/cuelang.org/go/internal/core/export/export.go b/vendor/cuelang.org/go/internal/core/export/export.go
index 015553adc..cfac72063 100644
--- a/vendor/cuelang.org/go/internal/core/export/export.go
+++ b/vendor/cuelang.org/go/internal/core/export/export.go
@@ -57,14 +57,9 @@ type Profile struct {
 	// Use unevaluated conjuncts for these error types
 	// IgnoreRecursive
 
-	// SelfContained exports a schema such that it does not rely on any imports.
-	SelfContained bool
-
-	// AddPackage causes a package clause to be added.
-	AddPackage bool
-
-	// InlineImports expands references to non-builtin packages.
-	InlineImports bool
+	// TODO: recurse over entire tree to determine transitive closure
+	// of what needs to be printed.
+	// IncludeDependencies bool
 }
 
 var Simplified = &Profile{
@@ -83,7 +78,6 @@ var Raw = &Profile{
 	ShowDefinitions: true,
 	ShowHidden:      true,
 	ShowDocs:        true,
-	AddPackage:      true,
 }
 
 var All = &Profile{
@@ -93,29 +87,26 @@ var All = &Profile{
 	ShowHidden:      true,
 	ShowDocs:        true,
 	ShowAttributes:  true,
-	AddPackage:      true,
 }
 
 // Concrete
 
 // Def exports v as a definition.
-// It resolves references that point outside any of the vertices in v.
 func Def(r adt.Runtime, pkgID string, v *adt.Vertex) (*ast.File, errors.Error) {
 	return All.Def(r, pkgID, v)
 }
 
 // Def exports v as a definition.
-// It resolves references that point outside any of the vertices in v.
-func (p *Profile) Def(r adt.Runtime, pkgID string, v *adt.Vertex) (f *ast.File, err errors.Error) {
+func (p *Profile) Def(r adt.Runtime, pkgID string, v *adt.Vertex) (*ast.File, errors.Error) {
 	e := newExporter(p, r, pkgID, v)
-	e.initPivot(v)
+	e.markUsedFeatures(v)
 
 	isDef := v.IsRecursivelyClosed()
 	if isDef {
 		e.inDefinition++
 	}
 
-	expr := e.expr(nil, v)
+	expr := e.expr(v)
 
 	if isDef {
 		e.inDefinition--
@@ -126,51 +117,45 @@ func (p *Profile) Def(r adt.Runtime, pkgID string, v *adt.Vertex) (f *ast.File,
 			)
 		}
 	}
-
-	return e.finalize(v, expr)
+	return e.toFile(v, expr)
 }
 
-// Expr exports the given unevaluated expression (schema mode).
-// It does not resolve references that point outside the given expession.
 func Expr(r adt.Runtime, pkgID string, n adt.Expr) (ast.Expr, errors.Error) {
 	return Simplified.Expr(r, pkgID, n)
 }
 
-// Expr exports the given unevaluated expression (schema mode).
-// It does not resolve references that point outside the given expression.
 func (p *Profile) Expr(r adt.Runtime, pkgID string, n adt.Expr) (ast.Expr, errors.Error) {
 	e := newExporter(p, r, pkgID, nil)
+	e.markUsedFeatures(n)
 
-	return e.expr(nil, n), nil
+	return e.expr(n), nil
 }
 
-func (e *exporter) toFile(v *adt.Vertex, x ast.Expr) *ast.File {
+func (e *exporter) toFile(v *adt.Vertex, x ast.Expr) (*ast.File, errors.Error) {
 	f := &ast.File{}
 
-	if e.cfg.AddPackage {
-		pkgName := ""
-		pkg := &ast.Package{}
-		for _, c := range v.Conjuncts {
-			f, _ := c.Source().(*ast.File)
-			if f == nil {
-				continue
-			}
+	pkgName := ""
+	pkg := &ast.Package{}
+	for _, c := range v.Conjuncts {
+		f, _ := c.Source().(*ast.File)
+		if f == nil {
+			continue
+		}
 
-			if _, name, _ := internal.PackageInfo(f); name != "" {
-				pkgName = name
-			}
+		if _, name, _ := internal.PackageInfo(f); name != "" {
+			pkgName = name
+		}
 
-			if e.cfg.ShowDocs {
-				if doc := internal.FileComment(f); doc != nil {
-					ast.AddComment(pkg, doc)
-				}
+		if e.cfg.ShowDocs {
+			if doc := internal.FileComment(f); doc != nil {
+				ast.AddComment(pkg, doc)
 			}
 		}
+	}
 
-		if pkgName != "" {
-			pkg.Name = ast.NewIdent(pkgName)
-			f.Decls = append(f.Decls, pkg)
-		}
+	if pkgName != "" {
+		pkg.Name = ast.NewIdent(pkgName)
+		f.Decls = append(f.Decls, pkg)
 	}
 
 	switch st := x.(type) {
@@ -183,39 +168,46 @@ func (e *exporter) toFile(v *adt.Vertex, x ast.Expr) *ast.File {
 	default:
 		f.Decls = append(f.Decls, &ast.EmbedDecl{Expr: x})
 	}
+	if err := astutil.Sanitize(f); err != nil {
+		err := errors.Promote(err, "export")
+		return f, errors.Append(e.errs, err)
+	}
 
-	return f
+	return f, nil
 }
 
-// Vertex exports evaluated values (data mode).
-// It resolves incomplete references that point outside the current context.
+// File
+
 func Vertex(r adt.Runtime, pkgID string, n *adt.Vertex) (*ast.File, errors.Error) {
 	return Simplified.Vertex(r, pkgID, n)
 }
 
-// Vertex exports evaluated values (data mode).
-// It resolves incomplete references that point outside the current context.
-func (p *Profile) Vertex(r adt.Runtime, pkgID string, n *adt.Vertex) (f *ast.File, err errors.Error) {
-	e := newExporter(p, r, pkgID, n)
-	e.initPivot(n)
-
+func (p *Profile) Vertex(r adt.Runtime, pkgID string, n *adt.Vertex) (*ast.File, errors.Error) {
+	e := exporter{
+		ctx:   eval.NewContext(r, nil),
+		cfg:   p,
+		index: r,
+		pkgID: pkgID,
+	}
+	e.markUsedFeatures(n)
 	v := e.value(n, n.Conjuncts...)
-	return e.finalize(n, v)
+
+	return e.toFile(n, v)
 }
 
-// Value exports evaluated values (data mode).
-// It does not resolve references that point outside the given Value.
 func Value(r adt.Runtime, pkgID string, n adt.Value) (ast.Expr, errors.Error) {
 	return Simplified.Value(r, pkgID, n)
 }
 
-// Value exports evaluated values (data mode).
-//
-// It does not resolve references that point outside the given Value.
-//
-// TODO: Should take context.
+// Should take context.
 func (p *Profile) Value(r adt.Runtime, pkgID string, n adt.Value) (ast.Expr, errors.Error) {
-	e := newExporter(p, r, pkgID, n)
+	e := exporter{
+		ctx:   eval.NewContext(r, nil),
+		cfg:   p,
+		index: r,
+		pkgID: pkgID,
+	}
+	e.markUsedFeatures(n)
 	v := e.value(n)
 	return v, e.errs
 }
@@ -233,13 +225,10 @@ type exporter struct {
 	stack []frame
 
 	inDefinition int // for close() wrapping.
-	inExpression int // for inlining decisions.
 
 	// hidden label handling
-	pkgID string
-	// pkgHash is used when mangling hidden identifiers of packages that are
-	// inlined.
-	pkgHash map[string]string
+	pkgID  string
+	hidden map[string]adt.Feature // adt.InvalidFeatures means more than one.
 
 	// If a used feature maps to an expression, it means it is assigned to a
 	// unique let expression.
@@ -249,50 +238,15 @@ type exporter struct {
 	letAlias    map[*ast.LetClause]*ast.LetClause
 
 	usedHidden map[string]bool
-
-	pivotter *pivotter
 }
 
-// newExporter creates and initializes an exporter.
-func newExporter(p *Profile, r adt.Runtime, pkgID string, v adt.Value) *exporter {
-	n, _ := v.(*adt.Vertex)
-	e := &exporter{
+func newExporter(p *Profile, r adt.Runtime, pkgID string, v *adt.Vertex) *exporter {
+	return &exporter{
 		cfg:   p,
-		ctx:   eval.NewContext(r, n),
+		ctx:   eval.NewContext(r, v),
 		index: r,
 		pkgID: pkgID,
 	}
-
-	e.markUsedFeatures(v)
-
-	return e
-}
-
-// initPivot initializes the pivotter to allow aligning a configuration around
-// a new root, if needed.
-func (e *exporter) initPivot(n *adt.Vertex) {
-	if !e.cfg.InlineImports &&
-		!e.cfg.SelfContained &&
-		n.Parent == nil {
-		return
-	}
-
-	e.initPivotter(n)
-}
-
-// finalize finalizes the result of an export. It is only needed for use cases
-// that require conversion to a File, Sanitization, and self containment.
-func (e *exporter) finalize(n *adt.Vertex, v ast.Expr) (f *ast.File, err errors.Error) {
-	f = e.toFile(n, v)
-
-	e.completePivot(f)
-
-	if err := astutil.Sanitize(f); err != nil {
-		err := errors.Promote(err, "export")
-		return f, errors.Append(e.errs, err)
-	}
-
-	return f, nil
 }
 
 func (e *exporter) markUsedFeatures(x adt.Expr) {
@@ -351,14 +305,10 @@ func (e *exporter) getFieldAlias(f *ast.Field, name string) string {
 
 func setFieldAlias(f *ast.Field, name string) {
 	if _, ok := f.Label.(*ast.Alias); !ok {
-		x := f.Label.(ast.Expr)
 		f.Label = &ast.Alias{
 			Ident: ast.NewIdent(name),
-			Expr:  x,
+			Expr:  f.Label.(ast.Expr),
 		}
-		ast.SetComments(f.Label, ast.Comments(x))
-		ast.SetComments(x, nil)
-		// TODO: move position information.
 	}
 }
 
@@ -423,31 +373,19 @@ func filterUnusedLets(s *ast.StructLit) {
 
 // resolveLet actually parses the let expression.
 // If there was no recorded let expression, it expands the expression in place.
-func (e *exporter) resolveLet(env *adt.Environment, x *adt.LetReference) ast.Expr {
+func (e *exporter) resolveLet(x *adt.LetReference) ast.Expr {
 	letClause, _ := x.Src.Node.(*ast.LetClause)
 	let := e.letAlias[letClause]
 
 	switch {
 	case let == nil:
-		ref, _ := e.ctx.Lookup(env, x)
-		if ref == nil {
-			// This can happen if x.X does not resolve to a valid value. At this
-			// point we will not get a valid configuration.
-
-			// TODO: get rid of the use of x.X.
-			// str := x.Label.IdentString(e.ctx)
-			// ident := ast.NewIdent(str)
-			// return ident
-
-			return e.expr(env, x.X)
-		}
-		return e.expr(env, ref.Conjuncts[0].Expr())
+		return e.expr(x.X)
 
 	case let.Expr == nil:
 		label := e.uniqueLetIdent(x.Label, x.X)
 
 		let.Ident = e.ident(label)
-		let.Expr = e.expr(env, x.X)
+		let.Expr = e.expr(x.X)
 	}
 
 	ident := ast.NewIdent(let.Ident.Name)
@@ -478,29 +416,6 @@ func (e *exporter) uniqueAlias(name string) string {
 	return name
 }
 
-// A featureSet implements a set of Features. It only supports testing
-// whether a given string is available as a Feature.
-type featureSet interface {
-	// intn returns a pseudo-random integer in [0..n).
-	intn(n int) int
-
-	// makeFeature converts s to f if it is available.
-	makeFeature(s string) (f adt.Feature, ok bool)
-}
-
-func (e *exporter) intn(n int) int {
-	return e.rand.Intn(n)
-}
-
-func (e *exporter) makeFeature(s string) (f adt.Feature, ok bool) {
-	f = adt.MakeIdentLabel(e.ctx, s, "")
-	_, exists := e.usedFeature[f]
-	if !exists {
-		e.usedFeature[f] = nil
-	}
-	return f, !exists
-}
-
 // uniqueFeature returns a name for an identifier that uniquely identifies
 // the given expression. If the preferred name is already taken, a new globally
 // unique name of the form base_X ... base_XXXXXXXXXXXXXX is generated.
@@ -508,22 +423,18 @@ func (e *exporter) makeFeature(s string) (f adt.Feature, ok bool) {
 // It prefers short extensions over large ones, while ensuring the likelihood of
 // fast termination is high. There are at least two digits to make it visually
 // clearer this concerns a generated number.
+//
 func (e *exporter) uniqueFeature(base string) (f adt.Feature, name string) {
 	if e.rand == nil {
 		e.rand = rand.New(rand.NewSource(808))
 	}
-	return findUnique(e, base)
-}
-
-func findUnique(set featureSet, base string) (f adt.Feature, name string) {
-	if f, ok := set.makeFeature(base); ok {
-		return f, base
-	}
 
 	// Try the first few numbers in sequence.
 	for i := 1; i < 5; i++ {
 		name := fmt.Sprintf("%s_%01X", base, i)
-		if f, ok := set.makeFeature(name); ok {
+		f := adt.MakeIdentLabel(e.ctx, name, "")
+		if _, ok := e.usedFeature[f]; !ok {
+			e.usedFeature[f] = nil
 			return f, name
 		}
 	}
@@ -532,9 +443,11 @@ func findUnique(set featureSet, base string) (f adt.Feature, name string) {
 	const shift = 4                  // rate of growth
 	digits := 1
 	for n := int64(0x10); ; n = int64(mask&((n<<shift)-1)) + 1 {
-		num := set.intn(int(n)-1) + 1
+		num := e.rand.Intn(int(n)-1) + 1
 		name := fmt.Sprintf("%[1]s_%0[2]*[3]X", base, digits, num)
-		if f, ok := set.makeFeature(name); ok {
+		f := adt.MakeIdentLabel(e.ctx, name, "")
+		if _, ok := e.usedFeature[f]; !ok {
+			e.usedFeature[f] = nil
 			return f, name
 		}
 		digits++
@@ -542,20 +455,14 @@ func findUnique(set featureSet, base string) (f adt.Feature, name string) {
 }
 
 type frame struct {
-	node *adt.Vertex
-
 	scope *ast.StructLit
 
 	docSources []adt.Conjunct
 
-	// For resolving pattern constraints  fields labels
+	// For resolving dynamic fields.
 	field     *ast.Field
 	labelExpr ast.Expr
-
-	dynamicFields []*entry
-
-	// for off-by-one handling
-	upCount int32
+	upCount   int32 // for off-by-one handling
 
 	// labeled fields
 	fields map[adt.Feature]entry
@@ -584,11 +491,10 @@ func (e *exporter) addEmbed(x ast.Expr) {
 	frame.scope.Elts = append(frame.scope.Elts, x)
 }
 
-func (e *exporter) pushFrame(src *adt.Vertex, conjuncts []adt.Conjunct) (s *ast.StructLit, saved []frame) {
+func (e *exporter) pushFrame(conjuncts []adt.Conjunct) (s *ast.StructLit, saved []frame) {
 	saved = e.stack
 	s = &ast.StructLit{}
 	e.stack = append(e.stack, frame{
-		node:       src,
 		scope:      s,
 		mapped:     map[adt.Node]ast.Node{},
 		fields:     map[adt.Feature]entry{},
@@ -618,17 +524,6 @@ func (e *exporter) top() *frame {
 	return &(e.stack[len(e.stack)-1])
 }
 
-func (e *exporter) node() *adt.Vertex {
-	if len(e.stack) == 0 {
-		return empty
-	}
-	n := e.stack[len(e.stack)-1].node
-	if n == nil {
-		return empty
-	}
-	return n
-}
-
 func (e *exporter) frame(upCount int32) *frame {
 	for i := len(e.stack) - 1; i >= 0; i-- {
 		f := &(e.stack[i])
diff --git a/vendor/cuelang.org/go/internal/core/export/expr.go b/vendor/cuelang.org/go/internal/core/export/expr.go
index 08f932749..c8d7a1290 100644
--- a/vendor/cuelang.org/go/internal/core/export/expr.go
+++ b/vendor/cuelang.org/go/internal/core/export/expr.go
@@ -47,26 +47,7 @@ import (
 // a common root and prefixing that to the reference. This is now possible
 // with the Environment construct and could be done later.
 
-var empty *adt.Vertex
-
-func init() {
-	// TODO: Consider setting a non-nil BaseValue.
-	empty = &adt.Vertex{}
-	empty.UpdateStatus(adt.Finalized)
-}
-
-// innerExpr is like expr, but prohibits inlining in certain cases.
-func (e *exporter) innerExpr(env *adt.Environment, v adt.Elem) (result ast.Expr) {
-	e.inExpression++
-	r := e.expr(env, v)
-	e.inExpression--
-	return r
-}
-
-// expr converts an ADT expression to an AST expression.
-// The env is used for resolution and does not need to be given if v is known
-// to not contain any references.
-func (e *exporter) expr(env *adt.Environment, v adt.Elem) (result ast.Expr) {
+func (e *exporter) expr(v adt.Elem) (result ast.Expr) {
 	switch x := v.(type) {
 	case nil:
 		return nil
@@ -79,23 +60,20 @@ func (e *exporter) expr(env *adt.Environment, v adt.Elem) (result ast.Expr) {
 
 		a := []conjunct{}
 		for _, c := range x.Conjuncts {
-			if c, ok := c.Elem().(*adt.Comprehension); ok && !c.DidResolve() {
-				continue
-			}
 			a = append(a, conjunct{c, 0})
 		}
 
 		return e.mergeValues(adt.InvalidLabel, x, a, x.Conjuncts...)
 
 	case *adt.StructLit:
-		c := adt.MakeRootConjunct(env, x)
+		c := adt.MakeRootConjunct(nil, x)
 		return e.mergeValues(adt.InvalidLabel, nil, []conjunct{{c: c, up: 0}}, c)
 
 	case adt.Value:
 		return e.value(x) // Use conjuncts.
 
 	default:
-		return e.adt(env, v)
+		return e.adt(v, nil)
 	}
 }
 
@@ -113,7 +91,7 @@ func (x *exporter) mergeValues(label adt.Feature, src *adt.Vertex, a []conjunct,
 		attrs:    []*ast.Attribute{},
 	}
 
-	s, saved := e.pushFrame(src, orig)
+	s, saved := e.pushFrame(orig)
 	defer e.popFrame(saved)
 
 	// Handle value aliases and lets
@@ -229,9 +207,6 @@ func (x *exporter) mergeValues(label adt.Feature, src *adt.Vertex, a []conjunct,
 	}
 
 	for _, f := range fields {
-		if f.IsLet() {
-			continue
-		}
 		field := e.fields[f]
 		c := field.conjuncts
 
@@ -270,7 +245,7 @@ func (x *exporter) mergeValues(label adt.Feature, src *adt.Vertex, a []conjunct,
 		}
 		if x.cfg.ShowAttributes {
 			for _, c := range a {
-				d.Attrs = extractFieldAttrs(d.Attrs, c.Field())
+				d.Attrs = extractFieldAttrs(d.Attrs, c)
 			}
 		}
 		s.Elts = append(s.Elts, d)
@@ -359,8 +334,8 @@ func (e *conjuncts) addExpr(env *adt.Environment, src *adt.Vertex, x adt.Elem, i
 
 		// Only add if it only has no bulk fields or elipsis.
 		if isComplexStruct(x) {
-			_, saved := e.pushFrame(src, nil)
-			e.embed = append(e.embed, e.adt(env, x))
+			_, saved := e.pushFrame(nil)
+			e.embed = append(e.embed, e.adt(x, nil))
 			e.top().upCount-- // not necessary, but for proper form
 			e.popFrame(saved)
 			return
@@ -368,8 +343,6 @@ func (e *conjuncts) addExpr(env *adt.Environment, src *adt.Vertex, x adt.Elem, i
 		// Used for sorting.
 		e.structs = append(e.structs, &adt.StructInfo{StructLit: x, Env: env})
 
-		env = &adt.Environment{Up: env, Vertex: e.node()}
-
 		for _, d := range x.Decls {
 			var label adt.Feature
 			switch f := d.(type) {
@@ -378,8 +351,6 @@ func (e *conjuncts) addExpr(env *adt.Environment, src *adt.Vertex, x adt.Elem, i
 			case *adt.OptionalField:
 				// TODO: mark optional here.
 				label = f.Label
-			case *adt.LetField:
-				continue
 			case *adt.Ellipsis:
 				e.hasEllipsis = true
 				continue
@@ -426,10 +397,6 @@ func (e *conjuncts) addExpr(env *adt.Environment, src *adt.Vertex, x adt.Elem, i
 				for _, a := range v.Arcs {
 					a.Finalize(e.ctx) // TODO: should we do this?
 
-					if !a.IsDefined(e.ctx) {
-						continue
-					}
-
 					e.addConjunct(a.Label, env, a)
 				}
 			}
@@ -444,9 +411,9 @@ func (e *conjuncts) addExpr(env *adt.Environment, src *adt.Vertex, x adt.Elem, i
 			e.addValueConjunct(src, env, x)
 		default:
 			if isEmbed {
-				e.embed = append(e.embed, e.expr(env, x))
+				e.embed = append(e.embed, e.expr(x))
 			} else {
-				e.conjuncts = append(e.conjuncts, e.expr(env, x))
+				e.conjuncts = append(e.conjuncts, e.expr(x))
 			}
 		}
 
@@ -455,11 +422,9 @@ func (e *conjuncts) addExpr(env *adt.Environment, src *adt.Vertex, x adt.Elem, i
 		case isSelfContained(x):
 			e.addValueConjunct(src, env, x)
 		case isEmbed:
-			e.embed = append(e.embed, e.expr(env, x))
+			e.embed = append(e.embed, e.expr(x))
 		default:
-			if x := e.expr(env, x); x != dummyTop {
-				e.conjuncts = append(e.conjuncts, x)
-			}
+			e.conjuncts = append(e.conjuncts, e.expr(x))
 		}
 	}
 }
@@ -516,8 +481,6 @@ func isComplexStruct(s *adt.StructLit) bool {
 				}
 			}
 
-		case *adt.LetField:
-
 		case adt.Expr:
 
 		case *adt.Ellipsis:
diff --git a/vendor/cuelang.org/go/internal/core/export/extract.go b/vendor/cuelang.org/go/internal/core/export/extract.go
index 087da045f..0a0d7d941 100644
--- a/vendor/cuelang.org/go/internal/core/export/extract.go
+++ b/vendor/cuelang.org/go/internal/core/export/extract.go
@@ -26,8 +26,9 @@ import (
 // Comments are attached to a field with a field shorthand belong to the
 // child node. So in the following the comment is attached to field bar.
 //
-//	// comment
-//	foo: bar: 2
+//     // comment
+//     foo: bar: 2
+//
 func ExtractDoc(v *adt.Vertex) (docs []*ast.CommentGroup) {
 	return extractDocs(v, v.Conjuncts)
 }
@@ -37,13 +38,12 @@ func extractDocs(v *adt.Vertex, a []adt.Conjunct) (docs []*ast.CommentGroup) {
 
 	// Collect docs directly related to this Vertex.
 	for _, x := range a {
-		// TODO: Is this still being used?
 		if v, ok := x.Elem().(*adt.Vertex); ok {
 			docs = append(docs, extractDocs(v, v.Conjuncts)...)
 			continue
 		}
 
-		switch f := x.Field().Source().(type) {
+		switch f := x.Source().(type) {
 		case *ast.Field:
 			if hasShorthandValue(f) {
 				continue
@@ -98,7 +98,8 @@ func extractDocs(v *adt.Vertex, a []adt.Conjunct) (docs []*ast.CommentGroup) {
 // hasShorthandValue reports whether this field has a struct value that will
 // be rendered as a shorthand, for instance:
 //
-//	f: g: 2
+//     f: g: 2
+//
 func hasShorthandValue(f *ast.Field) bool {
 	if f = nestedField(f); f == nil {
 		return false
@@ -145,18 +146,13 @@ func containsDoc(a []*ast.CommentGroup, cg *ast.CommentGroup) bool {
 
 func ExtractFieldAttrs(v *adt.Vertex) (attrs []*ast.Attribute) {
 	for _, x := range v.Conjuncts {
-		attrs = extractFieldAttrs(attrs, x.Field())
+		attrs = extractFieldAttrs(attrs, x)
 	}
 	return attrs
 }
 
-// extractFieldAttrs extracts the fields from n and appends unique entries to
-// attrs.
-//
-// The value of n should be obtained from the Conjunct.Field method if the
-// source for n is a Conjunct so that Comprehensions are properly unwrapped.
-func extractFieldAttrs(attrs []*ast.Attribute, n adt.Node) []*ast.Attribute {
-	if f, ok := n.Source().(*ast.Field); ok {
+func extractFieldAttrs(attrs []*ast.Attribute, c adt.Conjunct) []*ast.Attribute {
+	if f, ok := c.Source().(*ast.Field); ok {
 		for _, a := range f.Attrs {
 			if !containsAttr(attrs, a) {
 				attrs = append(attrs, a)
diff --git a/vendor/cuelang.org/go/internal/core/export/label.go b/vendor/cuelang.org/go/internal/core/export/label.go
index d4f2eb2d0..4e62d9e67 100644
--- a/vendor/cuelang.org/go/internal/core/export/label.go
+++ b/vendor/cuelang.org/go/internal/core/export/label.go
@@ -15,9 +15,6 @@
 package export
 
 import (
-	"crypto/md5"
-	"fmt"
-	"io"
 	"strconv"
 	"strings"
 
@@ -34,7 +31,7 @@ func (e *exporter) stringLabel(f adt.Feature) ast.Label {
 		return ast.NewLit(token.INT, strconv.Itoa(int(x)))
 
 	case adt.DefinitionLabel, adt.HiddenLabel, adt.HiddenDefinitionLabel:
-		s := e.identString(f)
+		s := f.IdentString(e.ctx)
 		return ast.NewIdent(s)
 
 	case adt.StringLabel:
@@ -49,58 +46,3 @@ func (e *exporter) stringLabel(f adt.Feature) ast.Label {
 		return ast.NewIdent(e.ctx.IndexToString(int64(x)))
 	}
 }
-
-// identString converts the given Feature f to an identifier string.
-//
-// Hidden field mangling:
-//
-// If f is a hidden field that comes from an expanded package, it will mangle
-// the name by expending it with the MD5 hash of the package name. This is to
-// avoid collissions of the hidden identifiers when namespaces are merged.
-// It uses the MD5 hash to allow hidden fields from the same package to
-// still match across inlining and unifications.
-//
-// TODO: Alternatives approaches to consider:
-//  1. Rewrite to unique hidden field names. This means, though, that hidden
-//     fields may not match across unifications. That may be okay.
-//  2. Force inline hidden fields from such packages, or translate them to let
-//     expressions when necessary. This should generally preserve semantics
-//     quite well.
-//  3. Allow addressing hidden fields across packages, for instance by allowing
-//     `_(hiddenField, pkg: "import/path")`. This kind of defeats the purpose
-//     of hidden fields, though.
-//
-// Option 2 seems the best long-term solution. It should be possible to
-// piggyback on the self containment algorithm for this: basically, whenever
-// we see a hidden reference of an inlined package, we treat it as an
-// external reference itself.
-//
-// For now, as this only can occur when the InlineImports feature is used,
-// we use this simpler approach.
-func (e *exporter) identString(f adt.Feature) string {
-	s := f.IdentString(e.ctx)
-
-	if !f.IsHidden() || !e.cfg.InlineImports {
-		return s
-	}
-
-	pkg := f.PkgID(e.ctx)
-	if pkg == "" || pkg == "_" || pkg == e.pkgID {
-		return s
-	}
-
-	if e.pkgHash == nil {
-		e.pkgHash = map[string]string{}
-	}
-	id, ok := e.pkgHash[pkg]
-	if !ok {
-		h := md5.New()
-		io.WriteString(h, pkg)
-		b := h.Sum(nil)
-		id = fmt.Sprintf("_%8X", b[:4])
-		e.pkgHash[pkg] = id
-	}
-	s += id
-
-	return s
-}
diff --git a/vendor/cuelang.org/go/internal/core/export/self.go b/vendor/cuelang.org/go/internal/core/export/self.go
deleted file mode 100644
index 05cb1b50e..000000000
--- a/vendor/cuelang.org/go/internal/core/export/self.go
+++ /dev/null
@@ -1,462 +0,0 @@
-// Copyright 2022 CUE Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package export
-
-import (
-	"fmt"
-	"strconv"
-	"strings"
-
-	"cuelang.org/go/cue/ast"
-	"cuelang.org/go/cue/token"
-	"cuelang.org/go/internal/core/adt"
-	"cuelang.org/go/internal/core/dep"
-)
-
-// This file contains the algorithm to contain a self-contained CUE file.
-
-// TODO:
-// - Handle below edge cases where a reference directly references the root
-//   of the exported main tree.
-// - Inline smallish structs that themselves do not have outside
-//   references.
-// - Overall better inlining.
-// - Consider a shorthand for the `let X = { #x: foo }` annotation. Possibly
-//   allow `#{}`, or allow "let definitions", like `let #X = {}`.
-// - Make doc comment of root the file comment.
-
-// initPivotter initializes a selfContainedCloser if either a subtree
-// is exported or imports need to be removed. It will not initialize one if
-// neither is the case.
-func (e *exporter) initPivotter(v *adt.Vertex) {
-	s := &pivotter{}
-	e.pivotter = s
-	s.x = e
-
-	s.depsMap = map[*adt.Vertex]*depData{}
-	s.refMap = map[adt.Resolver]*refData{}
-
-	s.linkDependencies(v)
-}
-
-func (e *exporter) completePivot(f *ast.File) {
-	s := e.pivotter
-	if s == nil || f == nil {
-		return
-	}
-	for _, d := range s.deps {
-		if !d.isExternalRoot() {
-			continue
-		}
-		s.addExternal(d)
-	}
-	f.Decls = append(f.Decls, s.decls...)
-}
-
-// A pivotter pivots a graph around a new root.
-//
-// Given a Vertex that itself is not the root of a configuration, the pivotter
-// recomputes the configuration to have that node as a root instead.
-//
-// TODO: although this is currently part of Package export, it could be its own
-// package down the line, if there is a proven need for it.
-type pivotter struct {
-	x *exporter
-
-	deps    []*depData
-	depsMap map[*adt.Vertex]*depData
-
-	refs   []*refData
-	refMap map[adt.Resolver]*refData
-
-	decls []ast.Decl
-}
-
-type depData struct {
-	parent *depData
-
-	dstNode   *adt.Vertex
-	dstImport *adt.ImportReference
-
-	ident        adt.Feature
-	path         []adt.Feature
-	useCount     int // Other reference using this vertex
-	included     bool
-	needTopLevel bool
-}
-
-// isExternalRoot reports whether d is an external node (a node referenced
-// outside main exported tree) that has no further parent nodes that are
-// referenced.
-func (d *depData) isExternalRoot() bool {
-	return d.ident != 0
-}
-
-func (d *depData) usageCount() int {
-	return getParent(d).useCount
-}
-
-type refData struct {
-	dst *depData
-	ref ast.Expr
-}
-
-func (v *depData) node() *adt.Vertex {
-	return v.dstNode
-}
-
-func (p *pivotter) linkDependencies(v *adt.Vertex) {
-	p.markDeps(v)
-
-	// Explicitly add the root of the configuration.
-	p.markIncluded(v)
-
-	// Link one parent up
-	for _, d := range p.depsMap {
-		p.markParentsPass1(d)
-	}
-
-	// Get transitive closure of parents.
-	for _, d := range p.depsMap {
-		if d.parent != nil {
-			d.parent = getParent(d)
-			d.parent.useCount++
-		}
-	}
-
-	// Compute the paths for the parent nodes.
-	for _, d := range p.deps {
-		if d.parent == nil {
-			p.makeParentPath(d)
-		}
-	}
-}
-
-func getParent(d *depData) *depData {
-	for ; d.parent != nil; d = d.parent {
-	}
-	return d
-}
-
-func (p *pivotter) markDeps(v *adt.Vertex) {
-	// TODO: sweep all child nodes and mark as no need for recursive checks.
-
-	dep.VisitAll(p.x.ctx, v, func(d dep.Dependency) error {
-		node := d.Node
-
-		switch {
-		case p.refMap[d.Reference] != nil:
-			// Already done.
-			return nil
-
-		case d.Import() != nil:
-			// Only record nodes within import if we want to expand imports.
-			if !p.x.cfg.InlineImports {
-				return nil
-			}
-
-			// Never resolve core packages. Reasons:
-			// - most of them are builtins
-			// - they are available anyway
-			// - some of the types have special meaning, which would be lost
-			//   by rewriting to their underlying type.
-			// TODO: support marking non-CUE packages as "special". This could
-			// be done, for instance, by marking them as "core" in the runtime
-			// and using a Runtime method to determine whether something is
-			// a core package, rather than relying on the precense of a dot.
-			path := d.Import().ImportPath.StringValue(p.x.ctx)
-			if !strings.ContainsRune(path, '.') {
-				return nil
-			}
-
-		case node.Status() == adt.Unprocessed:
-			// This may happen for DynamicReferences.
-			return nil
-		}
-
-		data, ok := p.depsMap[node]
-		if !ok {
-			data = &depData{
-				dstNode:   node,
-				dstImport: d.Import(),
-			}
-			p.depsMap[node] = data
-			p.deps = append(p.deps, data)
-		}
-		data.useCount++
-
-		ref := &refData{dst: data}
-		p.refs = append(p.refs, ref)
-		p.refMap[d.Reference] = ref
-
-		if !ok {
-			p.markDeps(node)
-		}
-
-		return nil
-	})
-}
-
-// markIncluded marks all referred nodes that are within the normal tree to be
-// exported.
-func (p *pivotter) markIncluded(v *adt.Vertex) {
-	d, ok := p.depsMap[v]
-	if !ok {
-		d = &depData{dstNode: v}
-		p.depsMap[v] = d
-	}
-	d.included = true
-
-	for _, a := range v.Arcs {
-		p.markIncluded(a)
-	}
-}
-
-// markParentPass1 marks the furthest ancestor node for which there is a
-// dependency as its parent. Only dependencies that do not have a parent
-// will be assigned to hidden reference.
-func (p *pivotter) markParentsPass1(d *depData) {
-	for n := d.node().Parent; n != nil; n = n.Parent {
-		if v, ok := p.depsMap[n]; ok {
-			d.parent = v
-		}
-	}
-}
-
-func (p *pivotter) makeParentPath(d *depData) {
-	if d.parent != nil {
-		panic("not a parent")
-	}
-
-	if d.included || d.isExternalRoot() {
-		return
-	}
-
-	var f adt.Feature
-
-	if path := d.dstNode.Path(); len(path) > 0 {
-		f = path[len(path)-1]
-	} else if imp := d.dstImport; imp != nil {
-		f = imp.Label
-	} else {
-		// This may legitimately happen for internal vertices, such as
-		// comprehension scopes.
-		return
-	}
-
-	str := f.IdentString(p.x.ctx)
-	str = strings.TrimLeft(str, "_#")
-	str = strings.ToUpper(str)
-	uf, _ := p.x.uniqueFeature(str)
-
-	d.path = []adt.Feature{uf}
-	d.ident = uf
-
-	// Make it a definition if we need it.
-	if d.dstNode.IsRecursivelyClosed() {
-		d.path = append(d.path, adt.MakeIdentLabel(p.x.ctx, "#x", ""))
-	}
-}
-
-// makeAlternativeReference computes the alternative path for the reference.
-func (p *pivotter) makeAlternativeReference(ref *refData, r adt.Resolver) ast.Expr {
-	d := ref.dst
-
-	// Determine if the reference can be inline.
-
-	var path []adt.Feature
-	if d.parent == nil {
-		// Get canonical vertexData.
-		path = d.path
-	} else {
-		pathLen, pkgRef := relPathLength(r)
-		path = d.node().Path()
-		count := d.stepsToParent()
-
-		switch {
-		case ref.dst.included:
-			// Inside main tree.
-			if count > pathLen {
-				// Cannot refer to root, so cannot use >=
-				return nil
-			}
-
-		case pkgRef:
-
-		default:
-			// Inside hoisted value.
-			if count >= pathLen {
-				return nil
-			}
-		}
-
-		path = path[len(path)-count:]
-		path = append(d.parent.path, path...)
-	}
-
-	if len(path) == 0 {
-		path = append(path, p.x.ctx.StringLabel("ROOT"))
-	}
-
-	var x ast.Expr = p.x.ident(path[0])
-
-	for _, f := range path[1:] {
-		if f.IsInt() {
-			x = &ast.IndexExpr{
-				X:     x,
-				Index: ast.NewLit(token.INT, strconv.Itoa(f.Index())),
-			}
-		} else {
-			x = &ast.SelectorExpr{
-				X:   x,
-				Sel: p.x.stringLabel(f),
-			}
-		}
-	}
-
-	return x
-}
-
-func (d *depData) stepsToParent() int {
-	parent := d.parent.node()
-	count := 0
-	for p := d.node(); p != parent; p = p.Parent {
-		if p == nil {
-			break
-		}
-		count++
-	}
-	return count
-}
-
-func relPathLength(r adt.Resolver) (length int, newRoot bool) {
-	for {
-		var expr adt.Expr
-		switch x := r.(type) {
-		case *adt.FieldReference,
-			*adt.DynamicReference,
-			*adt.LetReference,
-			*adt.ValueReference:
-			length++
-		case *adt.ImportReference:
-			// This reference indicates a different vertex as root, but doesn't
-			// increase the path length.
-			return length, true
-		case *adt.SelectorExpr:
-			length++
-			expr = x.X
-		case *adt.IndexExpr:
-			length++
-			expr = x.X
-		}
-
-		switch x := expr.(type) {
-		case nil:
-			return length, false
-		case adt.Resolver:
-			r = x
-		default:
-			panic("unreachable")
-		}
-	}
-}
-
-// refExpr returns a substituted expression for a given reference, or nil if
-// there are no changes. This function implements most of the policy to decide
-// when an expression can be inlined.
-func (p *pivotter) refExpr(r adt.Resolver) ast.Expr {
-	ref, ok := p.refMap[r]
-	if !ok {
-		return nil
-	}
-
-	dst := ref.dst
-	n := dst.node()
-
-	// Inline value, but only when this may not lead to an exponential
-	// expansion. We allow inlining when a value is only used once, or when
-	// it is a simple concrete scalar value.
-	switch {
-	case dst.included:
-		// Keep references that point inside the hoisted vertex.
-		// TODO: force hoisting. This would be akin to taking the interpretation
-		// that references that initially point outside the included vertex
-		// are external inputs too, even if they eventually point inside.
-	case p.x.inDefinition == 0 && n.IsRecursivelyClosed():
-		// We need to wrap the value in a definition.
-	case dst.usageCount() == 0:
-		// The root value itself.
-	case n.IsErr():
-		// Don't simplify for errors to make the position of the error clearer.
-	case !n.IsConcrete() && p.x.inExpression > 0:
-		// Don't simplify an expression that is known will fail.
-	case dst.usageCount() == 1 && p.x.inExpression == 0:
-		// Used only once.
-		fallthrough
-	case n.IsConcrete() && len(n.Arcs) == 0:
-		// Simple scalar value.
-		return p.x.expr(nil, n)
-	}
-
-	if r := p.makeAlternativeReference(ref, r); r != nil {
-		dst.needTopLevel = true
-		return r
-	}
-
-	return nil
-}
-
-// addExternal converts a vertex for an external reference.
-func (p *pivotter) addExternal(d *depData) {
-	if !d.needTopLevel {
-		return
-	}
-
-	expr := p.x.expr(nil, d.node())
-
-	if len(d.path) > 1 {
-		expr = ast.NewStruct(&ast.Field{
-			Label: p.x.stringLabel(d.path[1]),
-			Value: expr,
-		})
-	}
-	let := &ast.LetClause{
-		Ident: p.x.ident(d.path[0]),
-		Expr:  expr,
-	}
-
-	ast.SetRelPos(let, token.NewSection)
-
-	path := p.x.ctx.PathToString(p.x.ctx, d.node().Path())
-	var msg string
-	if d.dstImport == nil {
-		msg = fmt.Sprintf("//cue:path: %s", path)
-	} else {
-		pkg := d.dstImport.ImportPath.SelectorString(p.x.ctx)
-		if path == "" {
-			msg = fmt.Sprintf("//cue:path: %s", pkg)
-		} else {
-			msg = fmt.Sprintf("//cue:path: %s.%s", pkg, path)
-		}
-	}
-	cg := &ast.CommentGroup{
-		Doc:  true,
-		List: []*ast.Comment{{Text: msg}},
-	}
-	ast.SetRelPos(cg, token.NewSection)
-	ast.AddComment(let, cg)
-
-	p.decls = append(p.decls, let)
-}
diff --git a/vendor/cuelang.org/go/internal/core/export/toposort.go b/vendor/cuelang.org/go/internal/core/export/toposort.go
index 3688e27b1..7f68df972 100644
--- a/vendor/cuelang.org/go/internal/core/export/toposort.go
+++ b/vendor/cuelang.org/go/internal/core/export/toposort.go
@@ -25,7 +25,7 @@ import (
 
 // VertexFeatures returns the feature list of v. The list may include more
 // features than for which there are arcs and also includes features for
-// optional fields. It assumes the Structs fields are initialized and evaluated.
+// optional fields. It assumes the Structs fields is properly initialized.
 func VertexFeatures(c *adt.OpContext, v *adt.Vertex) []adt.Feature {
 	sets := extractFeatures(v.Structs)
 	m := sortArcs(sets) // TODO: use for convenience.
diff --git a/vendor/cuelang.org/go/internal/core/export/value.go b/vendor/cuelang.org/go/internal/core/export/value.go
index 706f0df37..53065e9e8 100644
--- a/vendor/cuelang.org/go/internal/core/export/value.go
+++ b/vendor/cuelang.org/go/internal/core/export/value.go
@@ -47,7 +47,7 @@ func (e *exporter) vertex(n *adt.Vertex) (result ast.Expr) {
 		attrs = ExtractDeclAttrs(n)
 	}
 
-	s, saved := e.pushFrame(n, n.Conjuncts)
+	s, saved := e.pushFrame(n.Conjuncts)
 	e.top().upCount++
 	defer func() {
 		e.top().upCount--
@@ -99,9 +99,7 @@ func (e *exporter) vertex(n *adt.Vertex) (result ast.Expr) {
 		// fall back to expression mode
 		a := []ast.Expr{}
 		for _, c := range n.Conjuncts {
-			if x := e.expr(c.Env, c.Elem()); x != dummyTop {
-				a = append(a, x)
-			}
+			a = append(a, e.expr(c.Elem()))
 		}
 		result = ast.NewBinExpr(token.AND, a...)
 	}
@@ -112,7 +110,7 @@ func (e *exporter) vertex(n *adt.Vertex) (result ast.Expr) {
 	if result != s && len(s.Elts) > 0 {
 		// There are used let expressions within a non-struct.
 		// For now we just fall back to the original expressions.
-		result = e.adt(nil, n)
+		result = e.adt(n, n.Conjuncts)
 	}
 
 	return result
@@ -187,7 +185,7 @@ func (e *exporter) value(n adt.Value, a ...adt.Conjunct) (result ast.Expr) {
 			return ast.NewIdent("_")
 		case 1:
 			if e.cfg.Simplify {
-				return e.expr(nil, x.Values[0])
+				return e.expr(x.Values[0])
 			}
 			return e.bareValue(x.Values[0])
 		}
@@ -216,7 +214,7 @@ func (e *exporter) value(n adt.Value, a ...adt.Conjunct) (result ast.Expr) {
 			if e.cfg.Simplify {
 				expr = e.bareValue(v)
 			} else {
-				expr = e.expr(nil, v)
+				expr = e.expr(v)
 			}
 			if i < x.NumDefaults {
 				expr = &ast.UnaryExpr{Op: token.MUL, X: expr}
@@ -341,10 +339,8 @@ func (e *exporter) listComposite(v *adt.Vertex) ast.Expr {
 		}
 		elem := e.vertex(a)
 
-		if e.cfg.ShowDocs {
-			docs := ExtractDoc(a)
-			ast.SetComments(elem, docs)
-		}
+		docs := ExtractDoc(a)
+		ast.SetComments(elem, docs)
 
 		l.Elts = append(l.Elts, elem)
 	}
@@ -458,7 +454,7 @@ func (e *exporter) structComposite(v *adt.Vertex, attrs []*ast.Attribute) ast.Ex
 			}
 
 			// fall back to expression mode.
-			f.Value = stripRefs(e.expr(nil, arc))
+			f.Value = stripRefs(e.expr(arc))
 
 			// TODO: remove use of stripRefs.
 			// f.Value = e.expr(arc)
diff --git a/vendor/cuelang.org/go/internal/core/runtime/build.go b/vendor/cuelang.org/go/internal/core/runtime/build.go
index 1fec9ec73..d3ecac7d8 100644
--- a/vendor/cuelang.org/go/internal/core/runtime/build.go
+++ b/vendor/cuelang.org/go/internal/core/runtime/build.go
@@ -21,7 +21,6 @@ import (
 	"cuelang.org/go/cue/ast/astutil"
 	"cuelang.org/go/cue/build"
 	"cuelang.org/go/cue/errors"
-	"cuelang.org/go/cue/stats"
 	"cuelang.org/go/cue/token"
 	"cuelang.org/go/internal"
 	"cuelang.org/go/internal/core/adt"
@@ -33,8 +32,6 @@ type Config struct {
 	Filename   string
 	ImportPath string
 
-	Counts *stats.Counts
-
 	compile.Config
 }
 
diff --git a/vendor/cuelang.org/go/internal/core/runtime/imports.go b/vendor/cuelang.org/go/internal/core/runtime/imports.go
index 4ac292c17..7903a3639 100644
--- a/vendor/cuelang.org/go/internal/core/runtime/imports.go
+++ b/vendor/cuelang.org/go/internal/core/runtime/imports.go
@@ -65,8 +65,6 @@ type index struct {
 	importsByPath  map[string]*adt.Vertex
 	importsByBuild map[*build.Instance]*adt.Vertex
 
-	nextUniqueID uint64
-
 	// These are initialized during Go package initialization time and do not
 	// need to be guarded.
 	builtinPaths map[string]PackageFunc // Full path
@@ -75,15 +73,6 @@ type index struct {
 	typeCache sync.Map // map[reflect.Type]evaluated
 }
 
-func (i *index) getNextUniqueID() uint64 {
-	// TODO: use atomic increment instead.
-	i.lock.Lock()
-	i.nextUniqueID++
-	x := i.nextUniqueID
-	i.lock.Unlock()
-	return x
-}
-
 func newIndex() *index {
 	i := &index{
 		imports:        map[*adt.Vertex]*build.Instance{},
diff --git a/vendor/cuelang.org/go/internal/core/runtime/index.go b/vendor/cuelang.org/go/internal/core/runtime/index.go
index edfdec014..a50e37808 100644
--- a/vendor/cuelang.org/go/internal/core/runtime/index.go
+++ b/vendor/cuelang.org/go/internal/core/runtime/index.go
@@ -29,10 +29,6 @@ func (r *Runtime) StringToIndex(s string) int64 {
 	return getKey(s)
 }
 
-func (r *Runtime) NextUniqueID() uint64 {
-	return r.index.getNextUniqueID()
-}
-
 func (r *Runtime) LabelStr(l adt.Feature) string {
 	return l.IdentString(r)
 }
diff --git a/vendor/cuelang.org/go/internal/core/subsume/structural.go b/vendor/cuelang.org/go/internal/core/subsume/structural.go
index 55ea533e3..450a03e18 100644
--- a/vendor/cuelang.org/go/internal/core/subsume/structural.go
+++ b/vendor/cuelang.org/go/internal/core/subsume/structural.go
@@ -58,6 +58,9 @@ func (s *subsumer) node(env *adt.Environment, up int32) *adt.Vertex {
 }
 
 func (s *subsumer) structural(a, b adt.Conjunct) bool {
+	if y, ok := b.Expr().(*adt.LetReference); ok {
+		return s.conjunct(a, s.c(b.Env, y.X))
+	}
 	if isBottomConjunct(b) {
 		return true
 	}
@@ -96,11 +99,7 @@ func (s *subsumer) structural(a, b adt.Conjunct) bool {
 		}
 
 	case *adt.LetReference:
-		if y, ok := b.Elem().(*adt.LetReference); ok && x.Label == y.Label {
-			if s.node(a.Env, x.UpCount) == s.node(b.Env, y.UpCount) {
-				return true
-			}
-		}
+		return s.conjunct(s.c(a.Env, x.X), b)
 
 	case *adt.SelectorExpr:
 		if y, ok := a.Elem().(*adt.SelectorExpr); ok &&
@@ -270,10 +269,12 @@ func (c *collatedDecls) collate(env *adt.Environment, s *adt.StructLit) {
 			c.additional = append(c.additional, x)
 
 		case *adt.Comprehension:
-			c.yielders = append(c.yielders, x.Clauses...)
+			c.yielders = append(c.yielders, x.Clauses)
 
 		case *adt.LetClause:
 			c.yielders = append(c.yielders, x)
+
+		case *adt.ValueClause:
 		}
 	}
 }
diff --git a/vendor/cuelang.org/go/internal/core/subsume/vertex.go b/vendor/cuelang.org/go/internal/core/subsume/vertex.go
index 121b7caa9..55f83dcff 100644
--- a/vendor/cuelang.org/go/internal/core/subsume/vertex.go
+++ b/vendor/cuelang.org/go/internal/core/subsume/vertex.go
@@ -22,9 +22,9 @@ import (
 )
 
 // Notes:
-//   - Can optional fields of y can always be ignored here? Maybe not in the
-//     schema case.
-//   - Definitions of y can be ignored in data mode.
+// - Can optional fields of y can always be ignored here? Maybe not in the
+//   schema case.
+// - Definitions of y can be ignored in data mode.
 //
 // TODO(perf): use merge sort where possible.
 func (s *subsumer) vertices(x, y *adt.Vertex) bool {
diff --git a/vendor/cuelang.org/go/internal/core/validate/validate.go b/vendor/cuelang.org/go/internal/core/validate/validate.go
index aaf469164..132c216df 100644
--- a/vendor/cuelang.org/go/internal/core/validate/validate.go
+++ b/vendor/cuelang.org/go/internal/core/validate/validate.go
@@ -98,9 +98,6 @@ func (v *validator) validate(x *adt.Vertex) {
 	}
 
 	for _, a := range x.Arcs {
-		if a.Label.IsLet() {
-			continue
-		}
 		if !v.AllErrors && v.err != nil {
 			break
 		}
diff --git a/vendor/cuelang.org/go/internal/core/walk/walk.go b/vendor/cuelang.org/go/internal/core/walk/walk.go
index 0d39e1345..3a12139f9 100644
--- a/vendor/cuelang.org/go/internal/core/walk/walk.go
+++ b/vendor/cuelang.org/go/internal/core/walk/walk.go
@@ -31,11 +31,21 @@ func Features(x adt.Expr, f func(label adt.Feature, src adt.Node)) {
 }
 
 type Visitor struct {
+	// TODO: lets really should be special fields
+	letDone map[adt.Expr]bool
+
 	Feature func(f adt.Feature, src adt.Node)
 	Before  func(adt.Node) bool
 }
 
+func (w *Visitor) init() {
+	if w.letDone == nil {
+		w.letDone = map[adt.Expr]bool{}
+	}
+}
+
 func (w *Visitor) Elem(x adt.Elem) {
+	w.init()
 	w.node(x)
 }
 
@@ -82,6 +92,13 @@ func (w *Visitor) node(n adt.Node) {
 
 	case *adt.LetReference:
 		w.feature(x.Label, x)
+		if w.letDone == nil {
+			w.letDone = map[adt.Expr]bool{}
+		}
+		if !w.letDone[x.X] {
+			w.letDone[x.X] = true
+			w.node(x.X)
+		}
 
 	case *adt.SelectorExpr:
 		w.node(x.X)
@@ -138,10 +155,6 @@ func (w *Visitor) node(n adt.Node) {
 		w.feature(x.Label, x)
 		w.node(x.Value)
 
-	case *adt.LetField:
-		w.feature(x.Label, x)
-		w.node(x.Value)
-
 	case *adt.BulkOptionalField:
 		w.node(x.Filter)
 		w.node(x.Value)
@@ -153,21 +166,22 @@ func (w *Visitor) node(n adt.Node) {
 	// Yielders
 
 	case *adt.Comprehension:
-		for _, c := range x.Clauses {
-			w.node(c)
-		}
-		w.node(adt.ToExpr(x.Value))
+		w.node(x.Clauses)
+		w.node(x.Value)
 
 	case *adt.ForClause:
 		w.feature(x.Key, x)
 		w.feature(x.Value, x)
+		w.node(x.Dst)
 
 	case *adt.IfClause:
 		w.node(x.Condition)
+		w.node(x.Dst)
 
 	case *adt.LetClause:
 		w.feature(x.Label, x)
 		w.node(x.Expr)
+		w.node(x.Dst)
 
 	case *adt.ValueClause:
 
diff --git a/vendor/cuelang.org/go/internal/encoding/yaml/encode.go b/vendor/cuelang.org/go/internal/encoding/yaml/encode.go
index 1fdc12d73..7eaf55c8c 100644
--- a/vendor/cuelang.org/go/internal/encoding/yaml/encode.go
+++ b/vendor/cuelang.org/go/internal/encoding/yaml/encode.go
@@ -28,7 +28,6 @@ import (
 	"cuelang.org/go/cue/errors"
 	"cuelang.org/go/cue/literal"
 	"cuelang.org/go/cue/token"
-	"cuelang.org/go/internal"
 	"cuelang.org/go/internal/astinternal"
 )
 
@@ -36,16 +35,15 @@ import (
 //
 // The given file must only contain values that can be directly supported by
 // YAML:
+//    Type          Restrictions
+//    BasicLit
+//    File          no imports, aliases, or definitions
+//    StructLit     no embeddings, aliases, or definitions
+//    List
+//    Field         must be regular; label must be a BasicLit or Ident
+//    CommentGroup
 //
-//	Type          Restrictions
-//	BasicLit
-//	File          no imports, aliases, or definitions
-//	StructLit     no embeddings, aliases, or definitions
-//	List
-//	Field         must be regular; label must be a BasicLit or Ident
-//	CommentGroup
-//
-// TODO: support anchors through Ident.
+//    TODO: support anchors through Ident.
 func Encode(n ast.Node) (b []byte, err error) {
 	y, err := encode(n)
 	if err != nil {
@@ -261,7 +259,7 @@ func encodeDecls(decls []ast.Decl) (n *yaml.Node, err error) {
 			continue
 
 		case *ast.Field:
-			if internal.IsDefinition(x.Label) {
+			if x.Token == token.ISA {
 				return nil, errors.Newf(x.TokenPos, "yaml: definition not allowed")
 			}
 			if x.Optional != token.NoPos {
@@ -366,7 +364,9 @@ func addDocs(n ast.Node, h, f *yaml.Node) {
 // that comments with empty lines get properly converted.
 func docToYAML(c *ast.CommentGroup) string {
 	s := c.Text()
-	s = strings.TrimSuffix(s, "\n") // always trims
+	if strings.HasSuffix(s, "\n") { // always true
+		s = s[:len(s)-1]
+	}
 	lines := strings.Split(s, "\n")
 	for i, l := range lines {
 		if l == "" {
diff --git a/vendor/cuelang.org/go/internal/internal.go b/vendor/cuelang.org/go/internal/internal.go
index 2e4003cbe..1dfc178f0 100644
--- a/vendor/cuelang.org/go/internal/internal.go
+++ b/vendor/cuelang.org/go/internal/internal.go
@@ -49,20 +49,6 @@ var MakeInstance func(value interface{}) (instance interface{})
 // BaseContext is used as CUEs default context for arbitrary-precision decimals
 var BaseContext = apd.BaseContext.WithPrecision(24)
 
-// APIVersionSupported is the back version until which deprecated features
-// are still supported.
-var APIVersionSupported = Version(MinorSupported, PatchSupported)
-
-const (
-	MinorCurrent   = 5
-	MinorSupported = 4
-	PatchSupported = 0
-)
-
-func Version(minor, patch int) int {
-	return -1000 + 100*minor + patch
-}
-
 // ListEllipsis reports the list type and remaining elements of a list. If we
 // ever relax the usage of ellipsis, this function will likely change. Using
 // this function will ensure keeping correct behavior or causing a compiler
diff --git a/vendor/cuelang.org/go/internal/source/source.go b/vendor/cuelang.org/go/internal/source/source.go
index 50d6b1ee3..384484449 100644
--- a/vendor/cuelang.org/go/internal/source/source.go
+++ b/vendor/cuelang.org/go/internal/source/source.go
@@ -27,6 +27,7 @@ import (
 // Read converts src to a []byte if possible; otherwise it returns an
 // error. If src == nil, readSource returns the result of reading the file
 // specified by filename.
+//
 func Read(filename string, src interface{}) ([]byte, error) {
 	if src != nil {
 		switch s := src.(type) {
diff --git a/vendor/cuelang.org/go/internal/task/task.go b/vendor/cuelang.org/go/internal/task/task.go
index c1cc82c5f..3fb6b5085 100644
--- a/vendor/cuelang.org/go/internal/task/task.go
+++ b/vendor/cuelang.org/go/internal/task/task.go
@@ -29,12 +29,11 @@ import (
 // A Context provides context for running a task.
 type Context struct {
 	Context context.Context
-
-	Stdin  io.Reader
-	Stdout io.Writer
-	Stderr io.Writer
-	Obj    cue.Value
-	Err    errors.Error
+	Stdin   io.Reader
+	Stdout  io.Writer
+	Stderr  io.Writer
+	Obj     cue.Value
+	Err     errors.Error
 }
 
 func (c *Context) Lookup(field string) cue.Value {
diff --git a/vendor/cuelang.org/go/internal/third_party/yaml/apic.go b/vendor/cuelang.org/go/internal/third_party/yaml/apic.go
index d515bdb5a..9cf9005f7 100644
--- a/vendor/cuelang.org/go/internal/third_party/yaml/apic.go
+++ b/vendor/cuelang.org/go/internal/third_party/yaml/apic.go
@@ -139,7 +139,7 @@ func yaml_emitter_set_canonical(emitter *yaml_emitter_t, canonical bool) {
 	emitter.canonical = canonical
 }
 
-// // Set the indentation increment.
+//// Set the indentation increment.
 func yaml_emitter_set_indent(emitter *yaml_emitter_t, indent int) {
 	if indent < 2 || indent > 9 {
 		indent = 2
diff --git a/vendor/cuelang.org/go/internal/third_party/yaml/decode.go b/vendor/cuelang.org/go/internal/third_party/yaml/decode.go
index c0af5613a..d3ec965ea 100644
--- a/vendor/cuelang.org/go/internal/third_party/yaml/decode.go
+++ b/vendor/cuelang.org/go/internal/third_party/yaml/decode.go
@@ -262,6 +262,7 @@ type decoder struct {
 	p            *parser
 	doc          *node
 	aliases      map[*node]bool
+	mapType      reflect.Type
 	terrors      []string
 	prev         token.Pos
 	lastNode     ast.Node
@@ -269,6 +270,7 @@ type decoder struct {
 }
 
 var (
+	mapItemType    = reflect.TypeOf(MapItem{})
 	durationType   = reflect.TypeOf(time.Duration(0))
 	defaultMapType = reflect.TypeOf(map[interface{}]interface{}{})
 	timeType       = reflect.TypeOf(time.Time{})
@@ -276,7 +278,7 @@ var (
 )
 
 func newDecoder(p *parser) *decoder {
-	d := &decoder{p: p}
+	d := &decoder{p: p, mapType: defaultMapType}
 	d.aliases = make(map[*node]bool)
 	return d
 }
@@ -521,8 +523,19 @@ func (d *decoder) scalar(n *node) ast.Expr {
 			Value:    "null",
 		}
 	}
-	d.terror(n, tag)
-	return &ast.BottomLit{}
+	err := &ast.BottomLit{
+		Bottom: d.pos(n.startPos),
+	}
+	comment := &ast.Comment{
+		Slash: d.start(n),
+		Text:  "// " + d.terror(n, tag),
+	}
+	err.AddComment(&ast.CommentGroup{
+		Line:     true,
+		Position: 1,
+		List:     []*ast.Comment{comment},
+	})
+	return err
 }
 
 func (d *decoder) label(n *node) ast.Label {
diff --git a/vendor/cuelang.org/go/internal/third_party/yaml/parserc.go b/vendor/cuelang.org/go/internal/third_party/yaml/parserc.go
index 6fcb5ec6f..aaf7f26df 100644
--- a/vendor/cuelang.org/go/internal/third_party/yaml/parserc.go
+++ b/vendor/cuelang.org/go/internal/third_party/yaml/parserc.go
@@ -177,8 +177,7 @@ func yaml_parser_state_machine(parser *yaml_parser_t, event *yaml_event_t) bool
 
 // Parse the production:
 // stream   ::= STREAM-START implicit_document? explicit_document* STREAM-END
-//
-//	************
+//              ************
 func yaml_parser_parse_stream_start(parser *yaml_parser_t, event *yaml_event_t) bool {
 	token := peek_token(parser)
 	if token == nil {
@@ -200,12 +199,9 @@ func yaml_parser_parse_stream_start(parser *yaml_parser_t, event *yaml_event_t)
 
 // Parse the productions:
 // implicit_document    ::= block_node DOCUMENT-END*
-//
-//	*
-//
+//                          *
 // explicit_document    ::= DIRECTIVE* DOCUMENT-START block_node? DOCUMENT-END*
-//
-//	*************************
+//                          *************************
 func yaml_parser_parse_document_start(parser *yaml_parser_t, event *yaml_event_t, implicit bool) bool {
 
 	token := peek_token(parser)
@@ -288,8 +284,8 @@ func yaml_parser_parse_document_start(parser *yaml_parser_t, event *yaml_event_t
 
 // Parse the productions:
 // explicit_document    ::= DIRECTIVE* DOCUMENT-START block_node? DOCUMENT-END*
+//                                                    ***********
 //
-//	***********
 func yaml_parser_parse_document_content(parser *yaml_parser_t, event *yaml_event_t) bool {
 	token := peek_token(parser)
 	if token == nil {
@@ -310,10 +306,9 @@ func yaml_parser_parse_document_content(parser *yaml_parser_t, event *yaml_event
 
 // Parse the productions:
 // implicit_document    ::= block_node DOCUMENT-END*
-//
-//	*************
-//
+//                                     *************
 // explicit_document    ::= DIRECTIVE* DOCUMENT-START block_node? DOCUMENT-END*
+//
 func yaml_parser_parse_document_end(parser *yaml_parser_t, event *yaml_event_t) bool {
 	token := peek_token(parser)
 	if token == nil {
@@ -344,41 +339,30 @@ func yaml_parser_parse_document_end(parser *yaml_parser_t, event *yaml_event_t)
 
 // Parse the productions:
 // block_node_or_indentless_sequence    ::=
-//
-//	ALIAS
-//	*****
-//	| properties (block_content | indentless_block_sequence)?
-//	  **********  *
-//	| block_content | indentless_block_sequence
-//	  *
-//
+//                          ALIAS
+//                          *****
+//                          | properties (block_content | indentless_block_sequence)?
+//                            **********  *
+//                          | block_content | indentless_block_sequence
+//                            *
 // block_node           ::= ALIAS
-//
-//	*****
-//	| properties block_content?
-//	  ********** *
-//	| block_content
-//	  *
-//
+//                          *****
+//                          | properties block_content?
+//                            ********** *
+//                          | block_content
+//                            *
 // flow_node            ::= ALIAS
-//
-//	*****
-//	| properties flow_content?
-//	  ********** *
-//	| flow_content
-//	  *
-//
+//                          *****
+//                          | properties flow_content?
+//                            ********** *
+//                          | flow_content
+//                            *
 // properties           ::= TAG ANCHOR? | ANCHOR TAG?
-//
-//	*************************
-//
+//                          *************************
 // block_content        ::= block_collection | flow_collection | SCALAR
-//
-//	******
-//
+//                                                               ******
 // flow_content         ::= flow_collection | SCALAR
-//
-//	******
+//                                            ******
 func yaml_parser_parse_node(parser *yaml_parser_t, event *yaml_event_t, block, indentless_sequence bool) bool {
 	//defer trace("yaml_parser_parse_node", "block:", block, "indentless_sequence:", indentless_sequence)()
 
@@ -597,8 +581,8 @@ func yaml_parser_parse_node(parser *yaml_parser_t, event *yaml_event_t, block, i
 
 // Parse the productions:
 // block_sequence ::= BLOCK-SEQUENCE-START (BLOCK-ENTRY block_node?)* BLOCK-END
+//                    ********************  *********** *             *********
 //
-//	********************  *********** *             *********
 func yaml_parser_parse_block_sequence_entry(parser *yaml_parser_t, event *yaml_event_t, first bool) bool {
 	if first {
 		token := peek_token(parser)
@@ -650,8 +634,7 @@ func yaml_parser_parse_block_sequence_entry(parser *yaml_parser_t, event *yaml_e
 
 // Parse the productions:
 // indentless_sequence  ::= (BLOCK-ENTRY block_node?)+
-//
-//	*********** *
+//                           *********** *
 func yaml_parser_parse_indentless_sequence_entry(parser *yaml_parser_t, event *yaml_event_t) bool {
 	token := peek_token(parser)
 	if token == nil {
@@ -688,14 +671,14 @@ func yaml_parser_parse_indentless_sequence_entry(parser *yaml_parser_t, event *y
 
 // Parse the productions:
 // block_mapping        ::= BLOCK-MAPPING_START
+//                          *******************
+//                          ((KEY block_node_or_indentless_sequence?)?
+//                            *** *
+//                          (VALUE block_node_or_indentless_sequence?)?)*
 //
-//	*******************
-//	((KEY block_node_or_indentless_sequence?)?
-//	  *** *
-//	(VALUE block_node_or_indentless_sequence?)?)*
+//                          BLOCK-END
+//                          *********
 //
-//	BLOCK-END
-//	*********
 func yaml_parser_parse_block_mapping_key(parser *yaml_parser_t, event *yaml_event_t, first bool) bool {
 	if first {
 		token := peek_token(parser)
@@ -747,11 +730,13 @@ func yaml_parser_parse_block_mapping_key(parser *yaml_parser_t, event *yaml_even
 // Parse the productions:
 // block_mapping        ::= BLOCK-MAPPING_START
 //
-//	((KEY block_node_or_indentless_sequence?)?
+//                          ((KEY block_node_or_indentless_sequence?)?
+//
+//                          (VALUE block_node_or_indentless_sequence?)?)*
+//                           ***** *
+//                          BLOCK-END
+//
 //
-//	(VALUE block_node_or_indentless_sequence?)?)*
-//	 ***** *
-//	BLOCK-END
 func yaml_parser_parse_block_mapping_value(parser *yaml_parser_t, event *yaml_event_t) bool {
 	token := peek_token(parser)
 	if token == nil {
@@ -779,18 +764,16 @@ func yaml_parser_parse_block_mapping_value(parser *yaml_parser_t, event *yaml_ev
 
 // Parse the productions:
 // flow_sequence        ::= FLOW-SEQUENCE-START
-//
-//	*******************
-//	(flow_sequence_entry FLOW-ENTRY)*
-//	 *                   **********
-//	flow_sequence_entry?
-//	*
-//	FLOW-SEQUENCE-END
-//	*****************
-//
+//                          *******************
+//                          (flow_sequence_entry FLOW-ENTRY)*
+//                           *                   **********
+//                          flow_sequence_entry?
+//                          *
+//                          FLOW-SEQUENCE-END
+//                          *****************
 // flow_sequence_entry  ::= flow_node | KEY flow_node? (VALUE flow_node?)?
+//                          *
 //
-//	*
 func yaml_parser_parse_flow_sequence_entry(parser *yaml_parser_t, event *yaml_event_t, first bool) bool {
 	if first {
 		token := peek_token(parser)
@@ -849,10 +832,11 @@ func yaml_parser_parse_flow_sequence_entry(parser *yaml_parser_t, event *yaml_ev
 	return true
 }
 
+//
 // Parse the productions:
 // flow_sequence_entry  ::= flow_node | KEY flow_node? (VALUE flow_node?)?
+//                                      *** *
 //
-//	*** *
 func yaml_parser_parse_flow_sequence_entry_mapping_key(parser *yaml_parser_t, event *yaml_event_t) bool {
 	token := peek_token(parser)
 	if token == nil {
@@ -872,8 +856,8 @@ func yaml_parser_parse_flow_sequence_entry_mapping_key(parser *yaml_parser_t, ev
 
 // Parse the productions:
 // flow_sequence_entry  ::= flow_node | KEY flow_node? (VALUE flow_node?)?
+//                                                      ***** *
 //
-//	***** *
 func yaml_parser_parse_flow_sequence_entry_mapping_value(parser *yaml_parser_t, event *yaml_event_t) bool {
 	token := peek_token(parser)
 	if token == nil {
@@ -896,8 +880,8 @@ func yaml_parser_parse_flow_sequence_entry_mapping_value(parser *yaml_parser_t,
 
 // Parse the productions:
 // flow_sequence_entry  ::= flow_node | KEY flow_node? (VALUE flow_node?)?
+//                                                                      *
 //
-//	*
 func yaml_parser_parse_flow_sequence_entry_mapping_end(parser *yaml_parser_t, event *yaml_event_t) bool {
 	token := peek_token(parser)
 	if token == nil {
@@ -914,17 +898,16 @@ func yaml_parser_parse_flow_sequence_entry_mapping_end(parser *yaml_parser_t, ev
 
 // Parse the productions:
 // flow_mapping         ::= FLOW-MAPPING-START
-//
-//	******************
-//	(flow_mapping_entry FLOW-ENTRY)*
-//	 *                  **********
-//	flow_mapping_entry?
-//	******************
-//	FLOW-MAPPING-END
-//	****************
-//
+//                          ******************
+//                          (flow_mapping_entry FLOW-ENTRY)*
+//                           *                  **********
+//                          flow_mapping_entry?
+//                          ******************
+//                          FLOW-MAPPING-END
+//                          ****************
 // flow_mapping_entry   ::= flow_node | KEY flow_node? (VALUE flow_node?)?
-//   - *** *
+//                          *           *** *
+//
 func yaml_parser_parse_flow_mapping_key(parser *yaml_parser_t, event *yaml_event_t, first bool) bool {
 	if first {
 		token := peek_token(parser)
@@ -989,7 +972,8 @@ func yaml_parser_parse_flow_mapping_key(parser *yaml_parser_t, event *yaml_event
 
 // Parse the productions:
 // flow_mapping_entry   ::= flow_node | KEY flow_node? (VALUE flow_node?)?
-//   - ***** *
+//                                   *                  ***** *
+//
 func yaml_parser_parse_flow_mapping_value(parser *yaml_parser_t, event *yaml_event_t, empty bool) bool {
 	token := peek_token(parser)
 	if token == nil {
diff --git a/vendor/cuelang.org/go/internal/third_party/yaml/resolve.go b/vendor/cuelang.org/go/internal/third_party/yaml/resolve.go
index f7ca87d7b..9699ada1a 100644
--- a/vendor/cuelang.org/go/internal/third_party/yaml/resolve.go
+++ b/vendor/cuelang.org/go/internal/third_party/yaml/resolve.go
@@ -77,7 +77,7 @@ func resolvableTag(tag string) bool {
 	return false
 }
 
-var yamlStyleFloat = regexp.MustCompile(`^[-+]?(\.[0-9]+|[0-9]+(\.[0-9]*)?)([eE][-+]?[0-9]+)?$`)
+var yamlStyleFloat = regexp.MustCompile(`^[-+]?[0-9]*\.?[0-9]+([eE][-+][0-9]+)?$`)
 
 func (d *decoder) resolve(n *node) (rtag string, out interface{}) {
 	tag := n.tag
diff --git a/vendor/cuelang.org/go/internal/third_party/yaml/scannerc.go b/vendor/cuelang.org/go/internal/third_party/yaml/scannerc.go
index 831a5c640..94ace4bd5 100644
--- a/vendor/cuelang.org/go/internal/third_party/yaml/scannerc.go
+++ b/vendor/cuelang.org/go/internal/third_party/yaml/scannerc.go
@@ -1496,11 +1496,11 @@ func yaml_parser_scan_to_next_token(parser *yaml_parser_t) bool {
 // Scan a YAML-DIRECTIVE or TAG-DIRECTIVE token.
 //
 // Scope:
+//      %YAML    1.1    # a comment \n
+//      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+//      %TAG    !yaml!  tag:yaml.org,2002:  \n
+//      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 //
-//	%YAML    1.1    # a comment \n
-//	^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-//	%TAG    !yaml!  tag:yaml.org,2002:  \n
-//	^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 func yaml_parser_scan_directive(parser *yaml_parser_t, token *yaml_token_t) bool {
 	// Eat '%'.
 	start_mark := parser.mark
@@ -1603,11 +1603,11 @@ func yaml_parser_scan_directive(parser *yaml_parser_t, token *yaml_token_t) bool
 // Scan the directive name.
 //
 // Scope:
+//      %YAML   1.1     # a comment \n
+//       ^^^^
+//      %TAG    !yaml!  tag:yaml.org,2002:  \n
+//       ^^^
 //
-//	%YAML   1.1     # a comment \n
-//	 ^^^^
-//	%TAG    !yaml!  tag:yaml.org,2002:  \n
-//	 ^^^
 func yaml_parser_scan_directive_name(parser *yaml_parser_t, start_mark yaml_mark_t, name *[]byte) bool {
 	// Consume the directive name.
 	if parser.unread < 1 && !yaml_parser_update_buffer(parser, 1) {
@@ -1642,9 +1642,8 @@ func yaml_parser_scan_directive_name(parser *yaml_parser_t, start_mark yaml_mark
 // Scan the value of VERSION-DIRECTIVE.
 //
 // Scope:
-//
-//	%YAML   1.1     # a comment \n
-//	     ^^^^^^
+//      %YAML   1.1     # a comment \n
+//           ^^^^^^
 func yaml_parser_scan_version_directive_value(parser *yaml_parser_t, start_mark yaml_mark_t, major, minor *int8) bool {
 	// Eat whitespaces.
 	if parser.unread < 1 && !yaml_parser_update_buffer(parser, 1) {
@@ -1682,11 +1681,10 @@ const max_number_length = 2
 // Scan the version number of VERSION-DIRECTIVE.
 //
 // Scope:
-//
-//	%YAML   1.1     # a comment \n
-//	        ^
-//	%YAML   1.1     # a comment \n
-//	          ^
+//      %YAML   1.1     # a comment \n
+//              ^
+//      %YAML   1.1     # a comment \n
+//                ^
 func yaml_parser_scan_version_directive_number(parser *yaml_parser_t, start_mark yaml_mark_t, number *int8) bool {
 
 	// Repeat while the next character is digit.
@@ -1720,9 +1718,9 @@ func yaml_parser_scan_version_directive_number(parser *yaml_parser_t, start_mark
 // Scan the value of a TAG-DIRECTIVE token.
 //
 // Scope:
+//      %TAG    !yaml!  tag:yaml.org,2002:  \n
+//          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 //
-//	%TAG    !yaml!  tag:yaml.org,2002:  \n
-//	    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 func yaml_parser_scan_tag_directive_value(parser *yaml_parser_t, start_mark yaml_mark_t, handle, prefix *[]byte) bool {
 	var handle_value, prefix_value []byte
 
diff --git a/vendor/cuelang.org/go/internal/third_party/yaml/yaml.go b/vendor/cuelang.org/go/internal/third_party/yaml/yaml.go
index 771a4af0b..517761459 100644
--- a/vendor/cuelang.org/go/internal/third_party/yaml/yaml.go
+++ b/vendor/cuelang.org/go/internal/third_party/yaml/yaml.go
@@ -2,7 +2,8 @@
 //
 // Source code and other details for the project are available at GitHub:
 //
-//	https://github.com/go-yaml/yaml
+//   https://github.com/go-yaml/yaml
+//
 package yaml // import "cuelang.org/go/internal/third_party/yaml"
 
 import (
@@ -17,13 +18,73 @@ import (
 	"cuelang.org/go/cue/ast"
 )
 
+// MapSlice encodes and decodes as a YAML map.
+// The order of keys is preserved when encoding and decoding.
+type MapSlice []MapItem
+
+// MapItem is an item in a MapSlice.
+type MapItem struct {
+	Key, Value interface{}
+}
+
+// The Unmarshaler interface may be implemented by types to customize their
+// behavior when being unmarshaled from a YAML document. The UnmarshalYAML
+// method receives a function that may be called to unmarshal the original
+// YAML value into a field or variable. It is safe to call the unmarshal
+// function parameter more than once if necessary.
+type Unmarshaler interface {
+	UnmarshalYAML(unmarshal func(interface{}) error) error
+}
+
+// The Marshaler interface may be implemented by types to customize their
+// behavior when being marshaled into a YAML document. The returned value
+// is marshaled in place of the original value implementing Marshaler.
+//
+// If an error is returned by MarshalYAML, the marshaling procedure stops
+// and returns with the provided error.
+type Marshaler interface {
+	MarshalYAML() (interface{}, error)
+}
+
 // Unmarshal decodes the first document found within the in byte slice
-// and returns it as a CUE syntax AST.
+// and assigns decoded values into the out value.
+//
+// Maps and pointers (to a struct, string, int, etc) are accepted as out
+// values. If an internal pointer within a struct is not initialized,
+// the yaml package will initialize it if necessary for unmarshalling
+// the provided data. The out parameter must not be nil.
+//
+// The type of the decoded values should be compatible with the respective
+// values in out. If one or more values cannot be decoded due to a type
+// mismatches, decoding continues partially until the end of the YAML
+// content, and a *yaml.TypeError is returned with details for all
+// missed values.
+//
+// Struct fields are only unmarshalled if they are exported (have an
+// upper case first letter), and are unmarshalled using the field name
+// lowercased as the default key. Custom keys may be defined via the
+// "yaml" name in the field tag: the content preceding the first comma
+// is used as the key, and the following comma-separated options are
+// used to tweak the marshalling process (see Marshal).
+// Conflicting names result in a runtime error.
+//
+// For example:
+//
+//     type T struct {
+//         F int `yaml:"a,omitempty"`
+//         B int
+//     }
+//     var t T
+//     yaml.Unmarshal([]byte("a: 1\nb: 2"), &t)
+//
+// See the documentation of Marshal for the format of tags and a list of
+// supported tag options.
+//
 func Unmarshal(filename string, in []byte) (expr ast.Expr, err error) {
 	return unmarshal(filename, in)
 }
 
-// A Decoder reads and decodes YAML values from an input stream.
+// A Decorder reads and decodes YAML values from an input stream.
 type Decoder struct {
 	strict    bool
 	firstDone bool
@@ -42,9 +103,12 @@ func NewDecoder(filename string, src interface{}) (*Decoder, error) {
 	return &Decoder{parser: d}, nil
 }
 
-// Decode reads the next YAML-encoded value from its input and returns
-// it as CUE syntax. It returns io.EOF if there are no more value in the
+// Decode reads the next YAML-encoded value from its input and stores it in the
+// value pointed to by v. It returns io.EOF if there are no more value in the
 // stream.
+//
+// See the documentation for Unmarshal for details about the conversion of YAML
+// into a Go value.
 func (dec *Decoder) Decode() (expr ast.Expr, err error) {
 	d := newDecoder(dec.parser)
 	defer handleErr(&err)
@@ -255,3 +319,51 @@ func getStructInfo(st reflect.Type) (*structInfo, error) {
 	fieldMapMutex.Unlock()
 	return sinfo, nil
 }
+
+// IsZeroer is used to check whether an object is zero to
+// determine whether it should be omitted when marshaling
+// with the omitempty flag. One notable implementation
+// is time.Time.
+type IsZeroer interface {
+	IsZero() bool
+}
+
+func isZero(v reflect.Value) bool {
+	kind := v.Kind()
+	if z, ok := v.Interface().(IsZeroer); ok {
+		if (kind == reflect.Ptr || kind == reflect.Interface) && v.IsNil() {
+			return true
+		}
+		return z.IsZero()
+	}
+	switch kind {
+	case reflect.String:
+		return len(v.String()) == 0
+	case reflect.Interface, reflect.Ptr:
+		return v.IsNil()
+	case reflect.Slice:
+		return v.Len() == 0
+	case reflect.Map:
+		return v.Len() == 0
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return v.Int() == 0
+	case reflect.Float32, reflect.Float64:
+		return v.Float() == 0
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64, reflect.Uintptr:
+		return v.Uint() == 0
+	case reflect.Bool:
+		return !v.Bool()
+	case reflect.Struct:
+		vt := v.Type()
+		for i := v.NumField() - 1; i >= 0; i-- {
+			if vt.Field(i).PkgPath != "" {
+				continue // Private field
+			}
+			if !isZero(v.Field(i)) {
+				return false
+			}
+		}
+		return true
+	}
+	return false
+}
diff --git a/vendor/cuelang.org/go/internal/third_party/yaml/yamlh.go b/vendor/cuelang.org/go/internal/third_party/yaml/yamlh.go
index 3d4367bb0..46ce46249 100644
--- a/vendor/cuelang.org/go/internal/third_party/yaml/yamlh.go
+++ b/vendor/cuelang.org/go/internal/third_party/yaml/yamlh.go
@@ -408,9 +408,7 @@ type yaml_document_t struct {
 // The number of written bytes should be set to the size_read variable.
 //
 // [in,out]   data        A pointer to an application data specified by
-//
-//	yaml_parser_set_input().
-//
+//                        yaml_parser_set_input().
 // [out]      buffer      The buffer to write the data from the source.
 // [in]       size        The size of the buffer.
 // [out]      size_read   The actual number of bytes read from the source.
@@ -619,14 +617,13 @@ type yaml_parser_t struct {
 // @a buffer to the output.
 //
 // @param[in,out]   data        A pointer to an application data specified by
-//
-//	yaml_emitter_set_output().
-//
+//                              yaml_emitter_set_output().
 // @param[in]       buffer      The buffer with bytes to be written.
 // @param[in]       size        The size of the buffer.
 //
 // @returns On success, the handler should return @c 1.  If the handler failed,
 // the returned value should be @c 0.
+//
 type yaml_write_handler_t func(emitter *yaml_emitter_t, buffer []byte) error
 
 type yaml_emitter_state_t int
diff --git a/vendor/cuelang.org/go/pkg/crypto/ed25519/pkg.go b/vendor/cuelang.org/go/pkg/crypto/ed25519/pkg.go
index ceb7917dc..9b10be43d 100644
--- a/vendor/cuelang.org/go/pkg/crypto/ed25519/pkg.go
+++ b/vendor/cuelang.org/go/pkg/crypto/ed25519/pkg.go
@@ -1,4 +1,7 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../../gen/gen.go
 
 package ed25519
 
diff --git a/vendor/cuelang.org/go/pkg/crypto/hmac/pkg.go b/vendor/cuelang.org/go/pkg/crypto/hmac/pkg.go
index f011963ac..98d72c984 100644
--- a/vendor/cuelang.org/go/pkg/crypto/hmac/pkg.go
+++ b/vendor/cuelang.org/go/pkg/crypto/hmac/pkg.go
@@ -1,4 +1,7 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../../gen/gen.go
 
 package hmac
 
diff --git a/vendor/cuelang.org/go/pkg/crypto/md5/pkg.go b/vendor/cuelang.org/go/pkg/crypto/md5/pkg.go
index 280266803..e4bbcda31 100644
--- a/vendor/cuelang.org/go/pkg/crypto/md5/pkg.go
+++ b/vendor/cuelang.org/go/pkg/crypto/md5/pkg.go
@@ -1,4 +1,7 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../../gen/gen.go
 
 package md5
 
diff --git a/vendor/cuelang.org/go/pkg/crypto/sha1/pkg.go b/vendor/cuelang.org/go/pkg/crypto/sha1/pkg.go
index 5ff857bad..979202497 100644
--- a/vendor/cuelang.org/go/pkg/crypto/sha1/pkg.go
+++ b/vendor/cuelang.org/go/pkg/crypto/sha1/pkg.go
@@ -1,4 +1,7 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../../gen/gen.go
 
 package sha1
 
diff --git a/vendor/cuelang.org/go/pkg/crypto/sha256/pkg.go b/vendor/cuelang.org/go/pkg/crypto/sha256/pkg.go
index c2013c943..92d851dfb 100644
--- a/vendor/cuelang.org/go/pkg/crypto/sha256/pkg.go
+++ b/vendor/cuelang.org/go/pkg/crypto/sha256/pkg.go
@@ -1,4 +1,7 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../../gen/gen.go
 
 package sha256
 
diff --git a/vendor/cuelang.org/go/pkg/crypto/sha512/pkg.go b/vendor/cuelang.org/go/pkg/crypto/sha512/pkg.go
index f98528076..607da475d 100644
--- a/vendor/cuelang.org/go/pkg/crypto/sha512/pkg.go
+++ b/vendor/cuelang.org/go/pkg/crypto/sha512/pkg.go
@@ -1,4 +1,7 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../../gen/gen.go
 
 package sha512
 
diff --git a/vendor/cuelang.org/go/pkg/doc.go b/vendor/cuelang.org/go/pkg/doc.go
index fc46bb72f..307e5cbf1 100644
--- a/vendor/cuelang.org/go/pkg/doc.go
+++ b/vendor/cuelang.org/go/pkg/doc.go
@@ -29,7 +29,7 @@
 //   - no querying of the file system of any kind
 //   - no communication on the network
 //   - no information about the type of environment
-//   - only reproducible random generators
+//   - only reproduceable random generators
 //
 // Hermetic configurations allow for fast and advanced analysis that otherwise
 // would not be possible or practical. The cue "cmd" command can be used to mix
diff --git a/vendor/cuelang.org/go/pkg/encoding/base64/pkg.go b/vendor/cuelang.org/go/pkg/encoding/base64/pkg.go
index af9cf17e6..12f791c4c 100644
--- a/vendor/cuelang.org/go/pkg/encoding/base64/pkg.go
+++ b/vendor/cuelang.org/go/pkg/encoding/base64/pkg.go
@@ -1,4 +1,7 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../../gen/gen.go
 
 package base64
 
diff --git a/vendor/cuelang.org/go/pkg/encoding/csv/pkg.go b/vendor/cuelang.org/go/pkg/encoding/csv/pkg.go
index 08fcfc580..f5c5482ea 100644
--- a/vendor/cuelang.org/go/pkg/encoding/csv/pkg.go
+++ b/vendor/cuelang.org/go/pkg/encoding/csv/pkg.go
@@ -1,4 +1,7 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../../gen/gen.go
 
 package csv
 
diff --git a/vendor/cuelang.org/go/pkg/encoding/hex/pkg.go b/vendor/cuelang.org/go/pkg/encoding/hex/pkg.go
index ad78c1df6..5918fe0c1 100644
--- a/vendor/cuelang.org/go/pkg/encoding/hex/pkg.go
+++ b/vendor/cuelang.org/go/pkg/encoding/hex/pkg.go
@@ -1,4 +1,7 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../../gen/gen.go
 
 package hex
 
diff --git a/vendor/cuelang.org/go/pkg/encoding/json/pkg.go b/vendor/cuelang.org/go/pkg/encoding/json/pkg.go
index a80712d3c..e0c195303 100644
--- a/vendor/cuelang.org/go/pkg/encoding/json/pkg.go
+++ b/vendor/cuelang.org/go/pkg/encoding/json/pkg.go
@@ -1,4 +1,7 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../../gen/gen.go
 
 package json
 
diff --git a/vendor/cuelang.org/go/pkg/encoding/yaml/manual.go b/vendor/cuelang.org/go/pkg/encoding/yaml/manual.go
index 634023d35..ee228f93a 100644
--- a/vendor/cuelang.org/go/pkg/encoding/yaml/manual.go
+++ b/vendor/cuelang.org/go/pkg/encoding/yaml/manual.go
@@ -20,16 +20,20 @@ import (
 
 	"cuelang.org/go/cue"
 	"cuelang.org/go/cue/ast"
-	"cuelang.org/go/cue/errors"
+	"cuelang.org/go/internal"
 	cueyaml "cuelang.org/go/internal/encoding/yaml"
 	"cuelang.org/go/internal/third_party/yaml"
-	"cuelang.org/go/pkg/internal"
 )
 
 // Marshal returns the YAML encoding of v.
 func Marshal(v cue.Value) (string, error) {
 	if err := v.Validate(cue.Concrete(true)); err != nil {
-		return "", err
+		if err := v.Validate(); err != nil {
+			return "", err
+		}
+		// TODO: allow adt.Bottom to implement errors.Error so that code and
+		// messages can be passed.
+		return "", internal.ErrIncomplete
 	}
 	n := v.Syntax(cue.Final(), cue.Concrete(true))
 	b, err := cueyaml.Encode(n)
@@ -50,7 +54,12 @@ func MarshalStream(v cue.Value) (string, error) {
 		}
 		v := iter.Value()
 		if err := v.Validate(cue.Concrete(true)); err != nil {
-			return "", err
+			if err := v.Validate(); err != nil {
+				return "", err
+			}
+			// TODO: allow adt.Bottom to implement errors.Error so that code and
+			// messages can be passed.
+			return "", internal.ErrIncomplete
 		}
 		n := v.Syntax(cue.Final(), cue.Concrete(true))
 		b, err := cueyaml.Encode(n)
@@ -125,11 +134,6 @@ func Validate(b []byte, v cue.Value) (bool, error) {
 			return false, err
 		}
 		if err := x.Validate(cue.Concrete(true)); err != nil {
-			// Strip error codes: incomplete errors are terminal in this case.
-			var b internal.Bottomer
-			if errors.As(err, &b) {
-				err = b.Bottom().Err
-			}
 			return false, err
 		}
 
diff --git a/vendor/cuelang.org/go/pkg/encoding/yaml/pkg.go b/vendor/cuelang.org/go/pkg/encoding/yaml/pkg.go
index baa782514..4889f7369 100644
--- a/vendor/cuelang.org/go/pkg/encoding/yaml/pkg.go
+++ b/vendor/cuelang.org/go/pkg/encoding/yaml/pkg.go
@@ -1,4 +1,7 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../../gen/gen.go
 
 package yaml
 
diff --git a/vendor/cuelang.org/go/pkg/gen.go b/vendor/cuelang.org/go/pkg/gen.go
deleted file mode 100644
index bb02bca18..000000000
--- a/vendor/cuelang.org/go/pkg/gen.go
+++ /dev/null
@@ -1,3 +0,0 @@
-package pkg
-
-//go:generate go run ./gen
diff --git a/vendor/cuelang.org/go/pkg/html/pkg.go b/vendor/cuelang.org/go/pkg/html/pkg.go
index c60dadf04..b68bed64e 100644
--- a/vendor/cuelang.org/go/pkg/html/pkg.go
+++ b/vendor/cuelang.org/go/pkg/html/pkg.go
@@ -1,4 +1,7 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../gen/gen.go
 
 package html
 
diff --git a/vendor/cuelang.org/go/pkg/internal/builtin.go b/vendor/cuelang.org/go/pkg/internal/builtin.go
index bb72f7f55..8de080531 100644
--- a/vendor/cuelang.org/go/pkg/internal/builtin.go
+++ b/vendor/cuelang.org/go/pkg/internal/builtin.go
@@ -30,19 +30,20 @@ import (
 //
 // A function may return and a constant may be any of the following types:
 //
-//	error (translates to bottom)
-//	nil   (translates to null)
-//	bool
-//	int*
-//	uint*
-//	float64
-//	string
-//	*big.Float
-//	*big.Int
+//   error (translates to bottom)
+//   nil   (translates to null)
+//   bool
+//   int*
+//   uint*
+//   float64
+//   string
+//   *big.Float
+//   *big.Int
+//
+//   For any of the above, including interface{} and these types recursively:
+//   []T
+//   map[string]T
 //
-//	For any of the above, including interface{} and these types recursively:
-//	[]T
-//	map[string]T
 type Builtin struct {
 	Name   string
 	Pkg    adt.Feature
@@ -74,11 +75,9 @@ func (p *Package) MustCompile(ctx *adt.OpContext, importPath string) *adt.Vertex
 
 		f := ctx.StringLabel(b.Name) // never starts with _
 		// n := &node{baseValue: newBase(imp.Path)}
-		var v adt.Expr
+		var v adt.Expr = toBuiltin(ctx, b)
 		if b.Const != "" {
 			v = mustParseConstBuiltin(ctx, b.Name, b.Const)
-		} else {
-			v = toBuiltin(ctx, b)
 		}
 		st.Decls = append(st.Decls, &adt.Field{
 			Label: f,
@@ -150,7 +149,7 @@ func toBuiltin(ctx *adt.OpContext, b *Builtin) *adt.Builtin {
 			return nil
 		case adt.Value:
 			return v
-		case Bottomer:
+		case bottomer:
 			// deal with API limitation: catch nil interface issue.
 			if b := v.Bottom(); b != nil {
 				return b
@@ -158,9 +157,7 @@ func toBuiltin(ctx *adt.OpContext, b *Builtin) *adt.Builtin {
 			return nil
 		}
 		if c.Err != nil {
-			if _, ok := c.Err.(ValidationError); !ok || c.ctx.IsValidator {
-				return nil
-			}
+			return nil
 		}
 		return convert.GoValueToValue(ctx, c.Ret, true)
 	}
@@ -197,21 +194,17 @@ func processErr(call *CallCtxt, errVal interface{}, ret adt.Expr) adt.Expr {
 	ctx := call.ctx
 	switch err := errVal.(type) {
 	case nil:
-	case ValidationError:
-		if call.ctx.IsValidator {
-			ret = err.B
-		}
 	case *adt.Bottom:
 		ret = err
 	case *callError:
 		ret = err.b
 	case *json.MarshalerError:
-		if err, ok := err.Err.(Bottomer); ok {
+		if err, ok := err.Err.(bottomer); ok {
 			if b := err.Bottom(); b != nil {
 				ret = b
 			}
 		}
-	case Bottomer:
+	case bottomer:
 		ret = wrapCallErr(call, err.Bottom())
 
 	case errors.Error:
diff --git a/vendor/cuelang.org/go/pkg/internal/context.go b/vendor/cuelang.org/go/pkg/internal/context.go
index 658991190..4a940e124 100644
--- a/vendor/cuelang.org/go/pkg/internal/context.go
+++ b/vendor/cuelang.org/go/pkg/internal/context.go
@@ -58,28 +58,14 @@ func (c *CallCtxt) Value(i int) cue.Value {
 	return v
 }
 
-func (c *CallCtxt) Struct(i int) Struct {
-	x := c.args[i]
-	switch v, ok := x.(*adt.Vertex); {
-	case ok && !v.IsList():
-		c.ctx.Unify(v, adt.Conjuncts)
-		return Struct{c.ctx, v}
-
-	case v != nil:
-		x = v.Value()
-	}
-	if x.Kind()&adt.StructKind == 0 {
-		var err error
-		if b, ok := x.(*adt.Bottom); ok {
-			err = &callError{b}
-		}
+func (c *CallCtxt) Struct(i int) *cue.Struct {
+	v := value.Make(c.ctx, c.args[i])
+	s, err := v.Struct()
+	if err != nil {
 		c.invalidArgType(c.args[i], i, "struct", err)
-	} else {
-		err := c.ctx.NewErrf("non-concrete struct for argument %d", i)
-		err.Code = adt.IncompleteError
-		c.Err = &callError{err}
+		return nil
 	}
-	return Struct{}
+	return s
 }
 
 func (c *CallCtxt) Int(i int) int     { return int(c.intValue(i, 64, "int64")) }
@@ -232,14 +218,6 @@ func (c *CallCtxt) List(i int) (a []cue.Value) {
 	return a
 }
 
-func (c *CallCtxt) CueList(i int) List {
-	v := c.getList(i)
-	if v == nil {
-		return List{}
-	}
-	return List{c.ctx, v, v.BaseValue.(*adt.ListMarker).IsOpen}
-}
-
 func (c *CallCtxt) Iter(i int) (a cue.Iterator) {
 	arg := c.args[i]
 	x := value.Make(c.ctx, arg)
diff --git a/vendor/cuelang.org/go/pkg/internal/errors.go b/vendor/cuelang.org/go/pkg/internal/errors.go
index 3257c0601..077a08dcd 100644
--- a/vendor/cuelang.org/go/pkg/internal/errors.go
+++ b/vendor/cuelang.org/go/pkg/internal/errors.go
@@ -21,7 +21,7 @@ import (
 	"cuelang.org/go/internal/core/adt"
 )
 
-type Bottomer interface {
+type bottomer interface {
 	error
 	Bottom() *adt.Bottom
 }
@@ -39,7 +39,7 @@ func (c *CallCtxt) errf(underlying error, format string, args ...interface{}) {
 	var code adt.ErrorCode
 	switch x := underlying.(type) {
 	case nil:
-	case Bottomer:
+	case bottomer:
 		b := x.Bottom()
 		errs = b.Err
 		code = b.Code
@@ -61,14 +61,15 @@ func (c *CallCtxt) errcf(code adt.ErrorCode, format string, args ...interface{})
 func wrapCallErr(c *CallCtxt, b *adt.Bottom) *adt.Bottom {
 	var err errors.Error
 	for _, e := range errors.Errors(b.Err) {
-		ne := c.ctx.Newf("error in call to %s", c.builtin.name(c.ctx))
-		err = errors.Append(err, errors.Wrap(ne, e))
+		const msg = "error in call to %s"
+		err = errors.Append(err,
+			errors.Wrapf(e, c.Pos(), msg, c.builtin.name(c.ctx)))
 	}
 	return &adt.Bottom{Code: b.Code, Err: err}
 }
 
 func (c *CallCtxt) invalidArgType(arg adt.Value, i int, typ string, err error) {
-	if ve, ok := err.(Bottomer); ok && ve.Bottom().IsIncomplete() {
+	if ve, ok := err.(bottomer); ok && ve.Bottom().IsIncomplete() {
 		c.Err = ve
 		return
 	}
@@ -76,15 +77,21 @@ func (c *CallCtxt) invalidArgType(arg adt.Value, i int, typ string, err error) {
 		c.Err = b
 		return
 	}
+	v, ok := arg.(adt.Value)
 	// TODO: make these permanent errors if the value did not originate from
 	// a reference.
+	if !ok {
+		c.errf(nil,
+			"cannot use incomplete value %s as %s in argument %d to %s",
+			arg, typ, i, c.Name())
+	}
 	if err != nil {
 		c.errf(err,
 			"cannot use %s (type %s) as %s in argument %d to %s",
-			arg, arg.Kind(), typ, i, c.Name())
+			arg, v.Kind(), typ, i, c.Name())
 	} else {
 		c.errf(err,
 			"cannot use %s (type %s) as %s in argument %d to %s",
-			arg, arg.Kind(), typ, i, c.Name())
+			arg, v.Kind(), typ, i, c.Name())
 	}
 }
diff --git a/vendor/cuelang.org/go/pkg/internal/types.go b/vendor/cuelang.org/go/pkg/internal/types.go
deleted file mode 100644
index 8b2d33731..000000000
--- a/vendor/cuelang.org/go/pkg/internal/types.go
+++ /dev/null
@@ -1,78 +0,0 @@
-// Copyright 2022 CUE Authors
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package internal
-
-import (
-	"cuelang.org/go/internal/core/adt"
-)
-
-// List represents a CUE list, which can be open or closed.
-type List struct {
-	runtime adt.Runtime
-	node    *adt.Vertex
-	isOpen  bool
-}
-
-// Elems returns the elements of a list.
-func (l *List) Elems() []*adt.Vertex {
-	return l.node.Elems()
-}
-
-// IsOpen reports whether a list is open ended.
-func (l *List) IsOpen() bool {
-	return l.isOpen
-}
-
-// Struct represents a CUE struct, which can be open or closed.
-type Struct struct {
-	runtime adt.Runtime
-	node    *adt.Vertex
-}
-
-// Arcs returns all arcs of s.
-func (s *Struct) Arcs() []*adt.Vertex {
-	return s.node.Arcs
-}
-
-// Len reports the number of regular string fields of s.
-func (s *Struct) Len() int {
-	count := 0
-	for _, a := range s.Arcs() {
-		if a.Label.IsString() {
-			count++
-		}
-	}
-	return count
-}
-
-// IsOpen reports whether s allows more fields than are currently defined.
-func (s *Struct) IsOpen() bool {
-	if !s.node.IsClosedStruct() {
-		return true
-	}
-	ot := s.node.OptionalTypes()
-	if ot&^(adt.HasField|adt.HasDynamic) != 0 {
-		return true
-	}
-	return false
-}
-
-// A ValidationError indicates an error that is only valid if a builtin is used
-// as a validator.
-type ValidationError struct {
-	B *adt.Bottom
-}
-
-func (v ValidationError) Error() string { return v.B.Err.Error() }
diff --git a/vendor/cuelang.org/go/pkg/list/list.go b/vendor/cuelang.org/go/pkg/list/list.go
index e2b5a0896..3f86e1d23 100644
--- a/vendor/cuelang.org/go/pkg/list/list.go
+++ b/vendor/cuelang.org/go/pkg/list/list.go
@@ -20,10 +20,6 @@ import (
 	"sort"
 
 	"cuelang.org/go/cue"
-	"cuelang.org/go/cue/errors"
-	"cuelang.org/go/cue/token"
-	"cuelang.org/go/internal/core/adt"
-	"cuelang.org/go/pkg/internal"
 )
 
 // Drop reports the suffix of list x after the first n elements,
@@ -31,11 +27,12 @@ import (
 //
 // For instance:
 //
-//	Drop([1, 2, 3, 4], 2)
+//    Drop([1, 2, 3, 4], 2)
 //
 // results in
 //
-//	[3, 4]
+//    [3, 4]
+//
 func Drop(x []cue.Value, n int) ([]cue.Value, error) {
 	if n < 0 {
 		return nil, fmt.Errorf("negative index")
@@ -53,7 +50,7 @@ func Drop(x []cue.Value, n int) ([]cue.Value, error) {
 //       extensions are introduced, which may provide flatten functionality
 //       natively.
 //
-// // Flatten reports a flattened sequence of the list xs by expanding any elements
+// // Flatten reports a flattend sequence of the list xs by expanding any elements
 // // that are lists.
 // //
 // // For instance:
@@ -89,16 +86,17 @@ func Drop(x []cue.Value, n int) ([]cue.Value, error) {
 // 	return flatten(xs)
 // }
 
-// FlattenN reports a flattened sequence of the list xs by expanding any elements
+// FlattenN reports a flattend sequence of the list xs by expanding any elements
 // depth levels deep. If depth is negative all elements are expanded.
 //
 // For instance:
 //
-//	FlattenN([1, [[2, 3], []], [4]], 1)
+//    FlattenN([1, [[2, 3], []], [4]], 1)
 //
 // results in
 //
-//	[1, [2, 3], [], 4]
+//    [1, [2, 3], [], 4]
+//
 func FlattenN(xs cue.Value, depth int) ([]cue.Value, error) {
 	var flattenN func(cue.Value, int) ([]cue.Value, error)
 	flattenN = func(xs cue.Value, depth int) ([]cue.Value, error) {
@@ -129,11 +127,12 @@ func FlattenN(xs cue.Value, depth int) ([]cue.Value, error) {
 //
 // For instance:
 //
-//	Repeat([1, 2], 2)
+//    Repeat([1, 2], 2)
 //
 // results in
 //
-//	[1, 2, 1, 2]
+//    [1, 2, 1, 2]
+//
 func Repeat(x []cue.Value, count int) ([]cue.Value, error) {
 	if count < 0 {
 		return nil, fmt.Errorf("negative count")
@@ -149,7 +148,8 @@ func Repeat(x []cue.Value, count int) ([]cue.Value, error) {
 //
 // Concat([a, b, c]) is equivalent to
 //
-//	[ for x in a {x}, for x in b {x}, for x in c {x} ]
+//     [ for x in a {x}, for x in b {x}, for x in c {x} ]
+//
 func Concat(a []cue.Value) ([]cue.Value, error) {
 	var res []cue.Value
 	for _, e := range a {
@@ -168,11 +168,12 @@ func Concat(a []cue.Value) ([]cue.Value, error) {
 //
 // For instance:
 //
-//	Take([1, 2, 3, 4], 2)
+//    Take([1, 2, 3, 4], 2)
 //
 // results in
 //
-//	[1, 2]
+//    [1, 2]
+//
 func Take(x []cue.Value, n int) ([]cue.Value, error) {
 	if n < 0 {
 		return nil, fmt.Errorf("negative index")
@@ -190,11 +191,12 @@ func Take(x []cue.Value, n int) ([]cue.Value, error) {
 //
 // For instance:
 //
-//	Slice([1, 2, 3, 4], 1, 3)
+//    Slice([1, 2, 3, 4], 1, 3)
 //
 // results in
 //
-//	[2, 3]
+//    [2, 3]
+//
 func Slice(x []cue.Value, i, j int) ([]cue.Value, error) {
 	if i < 0 {
 		return nil, fmt.Errorf("negative index")
@@ -216,32 +218,13 @@ func Slice(x []cue.Value, i, j int) ([]cue.Value, error) {
 }
 
 // MinItems reports whether a has at least n items.
-func MinItems(list internal.List, n int) (bool, error) {
-	count := len(list.Elems())
-	if count >= n {
-		return true, nil
-	}
-	code := adt.EvalError
-	if list.IsOpen() {
-		code = adt.IncompleteError
-	}
-	return false, internal.ValidationError{B: &adt.Bottom{
-		Code: code,
-		Err:  errors.Newf(token.NoPos, "len(list) < MinItems(%[2]d) (%[1]d < %[2]d)", count, n),
-	}}
+func MinItems(a []cue.Value, n int) bool {
+	return len(a) >= n
 }
 
 // MaxItems reports whether a has at most n items.
-func MaxItems(list internal.List, n int) (bool, error) {
-	count := len(list.Elems())
-	if count > n {
-		return false, internal.ValidationError{B: &adt.Bottom{
-			Code: adt.EvalError,
-			Err:  errors.Newf(token.NoPos, "len(list) > MaxItems(%[2]d) (%[1]d > %[2]d)", count, n),
-		}}
-	}
-
-	return true, nil
+func MaxItems(a []cue.Value, n int) bool {
+	return len(a) <= n
 }
 
 // UniqueItems reports whether all elements in the list are unique.
diff --git a/vendor/cuelang.org/go/pkg/list/math.go b/vendor/cuelang.org/go/pkg/list/math.go
index 47cec527f..c4f802a6f 100644
--- a/vendor/cuelang.org/go/pkg/list/math.go
+++ b/vendor/cuelang.org/go/pkg/list/math.go
@@ -92,11 +92,12 @@ func Product(xs []*internal.Decimal) (*internal.Decimal, error) {
 //
 // For instance:
 //
-//	Range(0, 5, 2)
+//    Range(0, 5, 2)
 //
 // results in
 //
-//	[0, 2, 4]
+//    [0, 2, 4]
+//
 func Range(start, limit, step *internal.Decimal) ([]*internal.Decimal, error) {
 	if step.IsZero() {
 		return nil, fmt.Errorf("step must be non zero")
diff --git a/vendor/cuelang.org/go/pkg/list/pkg.go b/vendor/cuelang.org/go/pkg/list/pkg.go
index 5f27a7e3b..f62ae6938 100644
--- a/vendor/cuelang.org/go/pkg/list/pkg.go
+++ b/vendor/cuelang.org/go/pkg/list/pkg.go
@@ -1,4 +1,7 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../gen/gen.go
 
 package list
 
@@ -100,9 +103,9 @@ var pkg = &internal.Package{
 		},
 		Result: adt.BoolKind,
 		Func: func(c *internal.CallCtxt) {
-			list, n := c.CueList(0), c.Int(1)
+			a, n := c.List(0), c.Int(1)
 			if c.Do() {
-				c.Ret, c.Err = MinItems(list, n)
+				c.Ret = MinItems(a, n)
 			}
 		},
 	}, {
@@ -113,9 +116,9 @@ var pkg = &internal.Package{
 		},
 		Result: adt.BoolKind,
 		Func: func(c *internal.CallCtxt) {
-			list, n := c.CueList(0), c.Int(1)
+			a, n := c.List(0), c.Int(1)
 			if c.Do() {
-				c.Ret, c.Err = MaxItems(list, n)
+				c.Ret = MaxItems(a, n)
 			}
 		},
 	}, {
diff --git a/vendor/cuelang.org/go/pkg/list/sort.go b/vendor/cuelang.org/go/pkg/list/sort.go
index fef137e9c..6e7125a83 100644
--- a/vendor/cuelang.org/go/pkg/list/sort.go
+++ b/vendor/cuelang.org/go/pkg/list/sort.go
@@ -60,9 +60,10 @@ func (s *valueSorter) Less(i, j int) bool {
 //
 // Example:
 //
-//	Sort([2, 3, 1], list.Ascending)
+//    Sort([2, 3, 1], list.Ascending)
+//
+//    Sort{{a: 2}, {a: 3}, {a: 1}, {x: {}, y: {}, less: x.a < y.a}}
 //
-//	Sort([{a: 2}, {a: 3}, {a: 1}], {x: {}, y: {}, less: x.a < y.a})
 func Sort(list []cue.Value, cmp cue.Value) (sorted []cue.Value, err error) {
 	s := valueSorter{list, cmp, nil}
 	// The input slice is already a copy and that we can modify it safely.
diff --git a/vendor/cuelang.org/go/pkg/math/bits/manual.go b/vendor/cuelang.org/go/pkg/math/bits/manual.go
index 87d153f47..16350e23d 100644
--- a/vendor/cuelang.org/go/pkg/math/bits/manual.go
+++ b/vendor/cuelang.org/go/pkg/math/bits/manual.go
@@ -78,6 +78,7 @@ func Xor(a, b *big.Int) *big.Int {
 }
 
 // Clear returns the bitwise and not of a and b (a &^ b in Go).
+//
 func Clear(a, b *big.Int) *big.Int {
 	var z big.Int
 	z.AndNot(a, b)
diff --git a/vendor/cuelang.org/go/pkg/math/bits/pkg.go b/vendor/cuelang.org/go/pkg/math/bits/pkg.go
index 8a1e96072..d3f1e4096 100644
--- a/vendor/cuelang.org/go/pkg/math/bits/pkg.go
+++ b/vendor/cuelang.org/go/pkg/math/bits/pkg.go
@@ -1,4 +1,7 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../../gen/gen.go
 
 package bits
 
diff --git a/vendor/cuelang.org/go/pkg/math/manual.go b/vendor/cuelang.org/go/pkg/math/manual.go
index 19c4a83d7..dd77dddae 100644
--- a/vendor/cuelang.org/go/pkg/math/manual.go
+++ b/vendor/cuelang.org/go/pkg/math/manual.go
@@ -43,7 +43,6 @@ func toInt(d *internal.Decimal) *big.Int {
 // Floor returns the greatest integer value less than or equal to x.
 //
 // Special cases are:
-//
 //	Floor(±0) = ±0
 //	Floor(±Inf) = ±Inf
 //	Floor(NaN) = NaN
@@ -57,7 +56,6 @@ func Floor(x *internal.Decimal) (*big.Int, error) {
 // Ceil returns the least integer value greater than or equal to x.
 //
 // Special cases are:
-//
 //	Ceil(±0) = ±0
 //	Ceil(±Inf) = ±Inf
 //	Ceil(NaN) = NaN
@@ -73,7 +71,6 @@ var roundTruncContext = roundContext(apd.RoundDown)
 // Trunc returns the integer value of x.
 //
 // Special cases are:
-//
 //	Trunc(±0) = ±0
 //	Trunc(±Inf) = ±Inf
 //	Trunc(NaN) = NaN
@@ -88,7 +85,6 @@ var roundUpContext = roundContext(apd.RoundHalfUp)
 // Round returns the nearest integer, rounding half away from zero.
 //
 // Special cases are:
-//
 //	Round(±0) = ±0
 //	Round(±Inf) = ±Inf
 //	Round(NaN) = NaN
@@ -103,7 +99,6 @@ var roundEvenContext = roundContext(apd.RoundHalfEven)
 // RoundToEven returns the nearest integer, rounding ties to even.
 //
 // Special cases are:
-//
 //	RoundToEven(±0) = ±0
 //	RoundToEven(±Inf) = ±Inf
 //	RoundToEven(NaN) = NaN
diff --git a/vendor/cuelang.org/go/pkg/math/math.go b/vendor/cuelang.org/go/pkg/math/math.go
index c76eaa1f5..ec2742927 100644
--- a/vendor/cuelang.org/go/pkg/math/math.go
+++ b/vendor/cuelang.org/go/pkg/math/math.go
@@ -40,7 +40,6 @@ func Abs(x *internal.Decimal) (*internal.Decimal, error) {
 // Acosh returns the inverse hyperbolic cosine of x.
 //
 // Special cases are:
-//
 //	Acosh(+Inf) = +Inf
 //	Acosh(x) = NaN if x < 1
 //	Acosh(NaN) = NaN
@@ -51,7 +50,6 @@ func Acosh(x float64) float64 {
 // Asin returns the arcsine, in radians, of x.
 //
 // Special cases are:
-//
 //	Asin(±0) = ±0
 //	Asin(x) = NaN if x < -1 or x > 1
 func Asin(x float64) float64 {
@@ -61,7 +59,6 @@ func Asin(x float64) float64 {
 // Acos returns the arccosine, in radians, of x.
 //
 // Special case is:
-//
 //	Acos(x) = NaN if x < -1 or x > 1
 func Acos(x float64) float64 {
 	return math.Acos(x)
@@ -70,7 +67,6 @@ func Acos(x float64) float64 {
 // Asinh returns the inverse hyperbolic sine of x.
 //
 // Special cases are:
-//
 //	Asinh(±0) = ±0
 //	Asinh(±Inf) = ±Inf
 //	Asinh(NaN) = NaN
@@ -81,9 +77,8 @@ func Asinh(x float64) float64 {
 // Atan returns the arctangent, in radians, of x.
 //
 // Special cases are:
-//
-//	Atan(±0) = ±0
-//	Atan(±Inf) = ±Pi/2
+//      Atan(±0) = ±0
+//      Atan(±Inf) = ±Pi/2
 func Atan(x float64) float64 {
 	return math.Atan(x)
 }
@@ -93,7 +88,6 @@ func Atan(x float64) float64 {
 // of the return value.
 //
 // Special cases are (in order):
-//
 //	Atan2(y, NaN) = NaN
 //	Atan2(NaN, x) = NaN
 //	Atan2(+0, x>=0) = +0
@@ -118,7 +112,6 @@ func Atan2(y, x float64) float64 {
 // Atanh returns the inverse hyperbolic tangent of x.
 //
 // Special cases are:
-//
 //	Atanh(1) = +Inf
 //	Atanh(±0) = ±0
 //	Atanh(-1) = -Inf
@@ -131,7 +124,6 @@ func Atanh(x float64) float64 {
 // Cbrt returns the cube root of x.
 //
 // Special cases are:
-//
 //	Cbrt(±0) = ±0
 //	Cbrt(±Inf) = ±Inf
 //	Cbrt(NaN) = NaN
@@ -172,7 +164,6 @@ var zero = apd.New(0, 0)
 // Dim returns the maximum of x-y or 0.
 //
 // Special cases are:
-//
 //	Dim(+Inf, +Inf) = NaN
 //	Dim(-Inf, -Inf) = NaN
 //	Dim(x, NaN) = Dim(NaN, x) = NaN
@@ -191,7 +182,6 @@ func Dim(x, y *internal.Decimal) (*internal.Decimal, error) {
 // Erf returns the error function of x.
 //
 // Special cases are:
-//
 //	Erf(+Inf) = 1
 //	Erf(-Inf) = -1
 //	Erf(NaN) = NaN
@@ -202,7 +192,6 @@ func Erf(x float64) float64 {
 // Erfc returns the complementary error function of x.
 //
 // Special cases are:
-//
 //	Erfc(+Inf) = 0
 //	Erfc(-Inf) = 2
 //	Erfc(NaN) = NaN
@@ -213,7 +202,6 @@ func Erfc(x float64) float64 {
 // Erfinv returns the inverse error function of x.
 //
 // Special cases are:
-//
 //	Erfinv(1) = +Inf
 //	Erfinv(-1) = -Inf
 //	Erfinv(x) = NaN if x < -1 or x > 1
@@ -225,7 +213,6 @@ func Erfinv(x float64) float64 {
 // Erfcinv returns the inverse of Erfc(x).
 //
 // Special cases are:
-//
 //	Erfcinv(0) = +Inf
 //	Erfcinv(2) = -Inf
 //	Erfcinv(x) = NaN if x < 0 or x > 2
@@ -237,10 +224,8 @@ func Erfcinv(x float64) float64 {
 // Exp returns e**x, the base-e exponential of x.
 //
 // Special cases are:
-//
 //	Exp(+Inf) = +Inf
 //	Exp(NaN) = NaN
-//
 // Very large values overflow to 0 or +Inf.
 // Very small values underflow to 1.
 func Exp(x *internal.Decimal) (*internal.Decimal, error) {
@@ -264,11 +249,9 @@ func Exp2(x *internal.Decimal) (*internal.Decimal, error) {
 // It is more accurate than Exp(x) - 1 when x is near zero.
 //
 // Special cases are:
-//
 //	Expm1(+Inf) = +Inf
 //	Expm1(-Inf) = -1
 //	Expm1(NaN) = NaN
-//
 // Very large values overflow to -1 or +Inf.
 func Expm1(x float64) float64 {
 	return math.Expm1(x)
@@ -277,7 +260,6 @@ func Expm1(x float64) float64 {
 // Gamma returns the Gamma function of x.
 //
 // Special cases are:
-//
 //	Gamma(+Inf) = +Inf
 //	Gamma(+0) = +Inf
 //	Gamma(-0) = -Inf
@@ -292,7 +274,6 @@ func Gamma(x float64) float64 {
 // unnecessary overflow and underflow.
 //
 // Special cases are:
-//
 //	Hypot(±Inf, q) = +Inf
 //	Hypot(p, ±Inf) = +Inf
 //	Hypot(NaN, q) = NaN
@@ -304,7 +285,6 @@ func Hypot(p, q float64) float64 {
 // J0 returns the order-zero Bessel function of the first kind.
 //
 // Special cases are:
-//
 //	J0(±Inf) = 0
 //	J0(0) = 1
 //	J0(NaN) = NaN
@@ -315,7 +295,6 @@ func J0(x float64) float64 {
 // Y0 returns the order-zero Bessel function of the second kind.
 //
 // Special cases are:
-//
 //	Y0(+Inf) = 0
 //	Y0(0) = -Inf
 //	Y0(x < 0) = NaN
@@ -327,7 +306,6 @@ func Y0(x float64) float64 {
 // J1 returns the order-one Bessel function of the first kind.
 //
 // Special cases are:
-//
 //	J1(±Inf) = 0
 //	J1(NaN) = NaN
 func J1(x float64) float64 {
@@ -337,7 +315,6 @@ func J1(x float64) float64 {
 // Y1 returns the order-one Bessel function of the second kind.
 //
 // Special cases are:
-//
 //	Y1(+Inf) = 0
 //	Y1(0) = -Inf
 //	Y1(x < 0) = NaN
@@ -349,7 +326,6 @@ func Y1(x float64) float64 {
 // Jn returns the order-n Bessel function of the first kind.
 //
 // Special cases are:
-//
 //	Jn(n, ±Inf) = 0
 //	Jn(n, NaN) = NaN
 func Jn(n int, x float64) float64 {
@@ -359,7 +335,6 @@ func Jn(n int, x float64) float64 {
 // Yn returns the order-n Bessel function of the second kind.
 //
 // Special cases are:
-//
 //	Yn(n, +Inf) = 0
 //	Yn(n ≥ 0, 0) = -Inf
 //	Yn(n < 0, 0) = +Inf if n is odd, -Inf if n is even
@@ -373,7 +348,6 @@ func Yn(n int, x float64) float64 {
 // It returns frac × 2**exp.
 //
 // Special cases are:
-//
 //	Ldexp(±0, exp) = ±0
 //	Ldexp(±Inf, exp) = ±Inf
 //	Ldexp(NaN, exp) = NaN
@@ -384,7 +358,6 @@ func Ldexp(frac float64, exp int) float64 {
 // Log returns the natural logarithm of x.
 //
 // Special cases are:
-//
 //	Log(+Inf) = +Inf
 //	Log(0) = -Inf
 //	Log(x < 0) = NaN
@@ -420,7 +393,6 @@ func Log2(x *internal.Decimal) (*internal.Decimal, error) {
 // It is more accurate than Log(1 + x) when x is near zero.
 //
 // Special cases are:
-//
 //	Log1p(+Inf) = +Inf
 //	Log1p(±0) = ±0
 //	Log1p(-1) = -Inf
@@ -433,7 +405,6 @@ func Log1p(x float64) float64 {
 // Logb returns the binary exponent of x.
 //
 // Special cases are:
-//
 //	Logb(±Inf) = +Inf
 //	Logb(0) = -Inf
 //	Logb(NaN) = NaN
@@ -444,7 +415,6 @@ func Logb(x float64) float64 {
 // Ilogb returns the binary exponent of x as an integer.
 //
 // Special cases are:
-//
 //	Ilogb(±Inf) = MaxInt32
 //	Ilogb(0) = MinInt32
 //	Ilogb(NaN) = MaxInt32
@@ -457,7 +427,6 @@ func Ilogb(x float64) int {
 // sign agrees with that of x.
 //
 // Special cases are:
-//
 //	Mod(±Inf, y) = NaN
 //	Mod(NaN, y) = NaN
 //	Mod(x, 0) = NaN
@@ -470,7 +439,6 @@ func Mod(x, y float64) float64 {
 // Pow returns x**y, the base-x exponential of y.
 //
 // Special cases are (in order):
-//
 //	Pow(x, ±0) = 1 for any x
 //	Pow(1, y) = 1 for any y
 //	Pow(x, 1) = x for any x
@@ -498,6 +466,7 @@ func Pow(x, y *internal.Decimal) (*internal.Decimal, error) {
 }
 
 // Pow10 returns 10**n, the base-10 exponential of n.
+//
 func Pow10(n int32) *internal.Decimal {
 	return apd.New(1, n)
 }
@@ -505,7 +474,6 @@ func Pow10(n int32) *internal.Decimal {
 // Remainder returns the IEEE 754 floating-point remainder of x/y.
 //
 // Special cases are:
-//
 //	Remainder(±Inf, y) = NaN
 //	Remainder(NaN, y) = NaN
 //	Remainder(x, 0) = NaN
@@ -523,7 +491,6 @@ func Signbit(x *internal.Decimal) bool {
 // Cos returns the cosine of the radian argument x.
 //
 // Special cases are:
-//
 //	Cos(±Inf) = NaN
 //	Cos(NaN) = NaN
 func Cos(x float64) float64 {
@@ -533,7 +500,6 @@ func Cos(x float64) float64 {
 // Sin returns the sine of the radian argument x.
 //
 // Special cases are:
-//
 //	Sin(±0) = ±0
 //	Sin(±Inf) = NaN
 //	Sin(NaN) = NaN
@@ -544,7 +510,6 @@ func Sin(x float64) float64 {
 // Sinh returns the hyperbolic sine of x.
 //
 // Special cases are:
-//
 //	Sinh(±0) = ±0
 //	Sinh(±Inf) = ±Inf
 //	Sinh(NaN) = NaN
@@ -555,7 +520,6 @@ func Sinh(x float64) float64 {
 // Cosh returns the hyperbolic cosine of x.
 //
 // Special cases are:
-//
 //	Cosh(±0) = 1
 //	Cosh(±Inf) = +Inf
 //	Cosh(NaN) = NaN
@@ -566,7 +530,6 @@ func Cosh(x float64) float64 {
 // Sqrt returns the square root of x.
 //
 // Special cases are:
-//
 //	Sqrt(+Inf) = +Inf
 //	Sqrt(±0) = ±0
 //	Sqrt(x < 0) = NaN
@@ -578,7 +541,6 @@ func Sqrt(x float64) float64 {
 // Tan returns the tangent of the radian argument x.
 //
 // Special cases are:
-//
 //	Tan(±0) = ±0
 //	Tan(±Inf) = NaN
 //	Tan(NaN) = NaN
@@ -589,7 +551,6 @@ func Tan(x float64) float64 {
 // Tanh returns the hyperbolic tangent of x.
 //
 // Special cases are:
-//
 //	Tanh(±0) = ±0
 //	Tanh(±Inf) = ±1
 //	Tanh(NaN) = NaN
diff --git a/vendor/cuelang.org/go/pkg/math/pkg.go b/vendor/cuelang.org/go/pkg/math/pkg.go
index 3a3b5bf52..dd758ffec 100644
--- a/vendor/cuelang.org/go/pkg/math/pkg.go
+++ b/vendor/cuelang.org/go/pkg/math/pkg.go
@@ -1,4 +1,7 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../gen/gen.go
 
 package math
 
diff --git a/vendor/cuelang.org/go/pkg/net/doc.go b/vendor/cuelang.org/go/pkg/net/doc.go
index a927e2ac9..adea9ac28 100644
--- a/vendor/cuelang.org/go/pkg/net/doc.go
+++ b/vendor/cuelang.org/go/pkg/net/doc.go
@@ -18,9 +18,10 @@
 // byte values. To allow one format over an other these types can be further
 // constraint using string or [...]. For instance,
 //
-//	// multicast defines a multicast IP address in string form.
-//	multicast: net.MulticastIP & string
+//    // multicast defines a multicast IP address in string form.
+//    multicast: net.MulticastIP & string
+//
+//    // unicast defines a global unicast IP address in list form.
+//    unicast: net.GlobalUnicastIP & [...]
 //
-//	// unicast defines a global unicast IP address in list form.
-//	unicast: net.GlobalUnicastIP & [...]
 package net
diff --git a/vendor/cuelang.org/go/pkg/net/pkg.go b/vendor/cuelang.org/go/pkg/net/pkg.go
index 61a67439a..3bf181cd4 100644
--- a/vendor/cuelang.org/go/pkg/net/pkg.go
+++ b/vendor/cuelang.org/go/pkg/net/pkg.go
@@ -1,4 +1,7 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../gen/gen.go
 
 package net
 
diff --git a/vendor/cuelang.org/go/pkg/path/match.go b/vendor/cuelang.org/go/pkg/path/match.go
index 7f371f755..b18d78cd6 100644
--- a/vendor/cuelang.org/go/pkg/path/match.go
+++ b/vendor/cuelang.org/go/pkg/path/match.go
@@ -51,6 +51,7 @@ var ErrBadPattern = errors.New("syntax error in pattern")
 //
 // On Windows, escaping is disabled. Instead, '\\' is treated as
 // path separator.
+//
 func Match(pattern, name string, o OS) (matched bool, err error) {
 	os := getOS(o)
 Pattern:
diff --git a/vendor/cuelang.org/go/pkg/path/path.go b/vendor/cuelang.org/go/pkg/path/path.go
index 4d1647c19..9f29dd2f5 100644
--- a/vendor/cuelang.org/go/pkg/path/path.go
+++ b/vendor/cuelang.org/go/pkg/path/path.go
@@ -74,13 +74,13 @@ func (b *lazybuf) string() string {
 // It applies the following rules
 // iteratively until no further processing can be done:
 //
-//  1. Replace multiple Separator elements with a single one.
-//  2. Eliminate each . path name element (the current directory).
-//  3. Eliminate each inner .. path name element (the parent directory)
-//     along with the non-.. element that precedes it.
-//  4. Eliminate .. elements that begin a rooted path:
-//     that is, replace "/.." by "/" at the beginning of a path,
-//     assuming Separator is '/'.
+//	1. Replace multiple Separator elements with a single one.
+//	2. Eliminate each . path name element (the current directory).
+//	3. Eliminate each inner .. path name element (the parent directory)
+//	   along with the non-.. element that precedes it.
+//	4. Eliminate .. elements that begin a rooted path:
+//	   that is, replace "/.." by "/" at the beginning of a path,
+//	   assuming Separator is '/'.
 //
 // The returned path ends in a slash only if it represents a root directory,
 // such as "/" on Unix or `C:\` on Windows.
@@ -90,8 +90,8 @@ func (b *lazybuf) string() string {
 // If the result of this process is an empty string, Clean
 // returns the string ".".
 //
-// See also Rob Pike, “Lexical File Names in Plan 9 or
-// Getting Dot-Dot Right,”
+// See also Rob Pike, ``Lexical File Names in Plan 9 or
+// Getting Dot-Dot Right,''
 // https://9p.io/sys/doc/lexnames.html
 func Clean(path string, os OS) string {
 	return clean(path, getOS(os))
diff --git a/vendor/cuelang.org/go/pkg/regexp/manual.go b/vendor/cuelang.org/go/pkg/regexp/manual.go
index eb3c1d240..4faf560b6 100644
--- a/vendor/cuelang.org/go/pkg/regexp/manual.go
+++ b/vendor/cuelang.org/go/pkg/regexp/manual.go
@@ -19,17 +19,14 @@
 // More precisely, it is the syntax accepted by RE2 and described at
 // https://golang.org/s/re2syntax, except for \C.
 // For an overview of the syntax, run
-//
-//	go doc regexp/syntax
+//   go doc regexp/syntax
 //
 // The regexp implementation provided by this package is
 // guaranteed to run in time linear in the size of the input.
 // (This is a property not guaranteed by most open source
 // implementations of regular expressions.) For more information
 // about this property, see
-//
 //	https://swtch.com/~rsc/regexp/regexp1.html
-//
 // or any book about automata theory.
 //
 // All characters are UTF-8-encoded code points.
@@ -143,12 +140,10 @@ func FindAllSubmatch(pattern, s string, n int) ([][]string, error) {
 // in capturing groups.
 //
 // Example:
-//
-//	regexp.FindNamedSubmatch(#"Hello (?P<person>\w*)!"#, "Hello World!")
-//
+//     regexp.FindNamedSubmatch(#"Hello (?P<person>\w*)!"#, "Hello World!")
 // Output:
+//     [{person: "World"}]
 //
-//	[{person: "World"}]
 func FindNamedSubmatch(pattern, s string) (map[string]string, error) {
 	re, err := regexp.Compile(pattern)
 	if err != nil {
diff --git a/vendor/cuelang.org/go/pkg/regexp/pkg.go b/vendor/cuelang.org/go/pkg/regexp/pkg.go
index 261497f67..4d7521333 100644
--- a/vendor/cuelang.org/go/pkg/regexp/pkg.go
+++ b/vendor/cuelang.org/go/pkg/regexp/pkg.go
@@ -1,4 +1,7 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../gen/gen.go
 
 package regexp
 
diff --git a/vendor/cuelang.org/go/pkg/strconv/pkg.go b/vendor/cuelang.org/go/pkg/strconv/pkg.go
index 5272e88ac..bc78f9ee2 100644
--- a/vendor/cuelang.org/go/pkg/strconv/pkg.go
+++ b/vendor/cuelang.org/go/pkg/strconv/pkg.go
@@ -1,4 +1,7 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../gen/gen.go
 
 package strconv
 
@@ -142,7 +145,7 @@ var pkg = &internal.Package{
 		},
 		Result: adt.StringKind,
 		Func: func(c *internal.CallCtxt) {
-			i, base := c.BigInt(0), c.Int(1)
+			i, base := c.Uint64(0), c.Int(1)
 			if c.Do() {
 				c.Ret = FormatUint(i, base)
 			}
@@ -155,7 +158,7 @@ var pkg = &internal.Package{
 		},
 		Result: adt.StringKind,
 		Func: func(c *internal.CallCtxt) {
-			i, base := c.BigInt(0), c.Int(1)
+			i, base := c.Int64(0), c.Int(1)
 			if c.Do() {
 				c.Ret = FormatInt(i, base)
 			}
diff --git a/vendor/cuelang.org/go/pkg/strconv/strconv.go b/vendor/cuelang.org/go/pkg/strconv/strconv.go
index 7a049c969..b6dc2995a 100644
--- a/vendor/cuelang.org/go/pkg/strconv/strconv.go
+++ b/vendor/cuelang.org/go/pkg/strconv/strconv.go
@@ -20,10 +20,7 @@
 
 package strconv
 
-import (
-	"math/big"
-	"strconv"
-)
+import "strconv"
 
 // ParseBool returns the boolean value represented by the string.
 // It accepts 1, t, T, TRUE, true, True, 0, f, F, FALSE, false, False.
@@ -153,19 +150,17 @@ func FormatFloat(f float64, fmt byte, prec, bitSize int) string {
 }
 
 // FormatUint returns the string representation of i in the given base,
-// for 2 <= base <= 62. The result uses:
-// For 10 <= digit values <= 35, the lower-case letters 'a' to 'z'
-// For 36 <= digit values <= 61, the upper-case letters 'A' to 'Z'
-func FormatUint(i *big.Int, base int) string {
-	return i.Text(base)
+// for 2 <= base <= 36. The result uses the lower-case letters 'a' to 'z'
+// for digit values >= 10.
+func FormatUint(i uint64, base int) string {
+	return strconv.FormatUint(i, base)
 }
 
 // FormatInt returns the string representation of i in the given base,
-// for 2 <= base <= 62. The result uses:
-// For 10 <= digit values <= 35, the lower-case letters 'a' to 'z'
-// For 36 <= digit values <= 61, the upper-case letters 'A' to 'Z'
-func FormatInt(i *big.Int, base int) string {
-	return i.Text(base)
+// for 2 <= base <= 36. The result uses the lower-case letters 'a' to 'z'
+// for digit values >= 10.
+func FormatInt(i int64, base int) string {
+	return strconv.FormatInt(i, base)
 }
 
 // Quote returns a double-quoted Go string literal representing s. The
diff --git a/vendor/cuelang.org/go/pkg/strings/manual.go b/vendor/cuelang.org/go/pkg/strings/manual.go
index 9179cd26a..9f538708d 100644
--- a/vendor/cuelang.org/go/pkg/strings/manual.go
+++ b/vendor/cuelang.org/go/pkg/strings/manual.go
@@ -18,9 +18,9 @@
 // Some of the functions in this package are specifically intended as field
 // constraints. For instance, MaxRunes as used in this CUE program
 //
-//	import "strings"
+//    import "strings"
 //
-//	myString: strings.MaxRunes(5)
+//    myString: strings.MaxRunes(5)
 //
 // specifies that the myString should be at most 5 code points.
 package strings
diff --git a/vendor/cuelang.org/go/pkg/strings/pkg.go b/vendor/cuelang.org/go/pkg/strings/pkg.go
index 400ac1dc5..b8b9cebc8 100644
--- a/vendor/cuelang.org/go/pkg/strings/pkg.go
+++ b/vendor/cuelang.org/go/pkg/strings/pkg.go
@@ -1,4 +1,7 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../gen/gen.go
 
 package strings
 
diff --git a/vendor/cuelang.org/go/pkg/strings/strings.go b/vendor/cuelang.org/go/pkg/strings/strings.go
index 308e4316c..14082b902 100644
--- a/vendor/cuelang.org/go/pkg/strings/strings.go
+++ b/vendor/cuelang.org/go/pkg/strings/strings.go
@@ -70,10 +70,9 @@ func LastIndexAny(s, chars string) int {
 // the substrings between those separators.
 //
 // The count determines the number of substrings to return:
-//
-//	n > 0: at most n substrings; the last substring will be the unsplit remainder.
-//	n == 0: the result is nil (zero substrings)
-//	n < 0: all substrings
+//   n > 0: at most n substrings; the last substring will be the unsplit remainder.
+//   n == 0: the result is nil (zero substrings)
+//   n < 0: all substrings
 //
 // Edge cases for s and sep (for example, empty strings) are handled
 // as described in the documentation for Split.
@@ -85,10 +84,9 @@ func SplitN(s, sep string, n int) []string {
 // returns a slice of those substrings.
 //
 // The count determines the number of substrings to return:
-//
-//	n > 0: at most n substrings; the last substring will be the unsplit remainder.
-//	n == 0: the result is nil (zero substrings)
-//	n < 0: all substrings
+//   n > 0: at most n substrings; the last substring will be the unsplit remainder.
+//   n == 0: the result is nil (zero substrings)
+//   n < 0: all substrings
 //
 // Edge cases for s and sep (for example, empty strings) are handled
 // as described in the documentation for SplitAfter.
diff --git a/vendor/cuelang.org/go/pkg/struct/pkg.go b/vendor/cuelang.org/go/pkg/struct/pkg.go
index 18f2fe6da..f7bf56e86 100644
--- a/vendor/cuelang.org/go/pkg/struct/pkg.go
+++ b/vendor/cuelang.org/go/pkg/struct/pkg.go
@@ -1,4 +1,7 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../gen/gen.go
 
 package structs
 
@@ -20,11 +23,11 @@ var pkg = &internal.Package{
 			{Kind: adt.StructKind},
 			{Kind: adt.IntKind},
 		},
-		Result: adt.BoolKind,
+		Result: adt.BottomKind,
 		Func: func(c *internal.CallCtxt) {
 			object, n := c.Struct(0), c.Int(1)
 			if c.Do() {
-				c.Ret, c.Err = MinFields(object, n)
+				c.Ret = MinFields(object, n)
 			}
 		},
 	}, {
diff --git a/vendor/cuelang.org/go/pkg/struct/struct.go b/vendor/cuelang.org/go/pkg/struct/struct.go
index 0c9401d69..2dd37ca0f 100644
--- a/vendor/cuelang.org/go/pkg/struct/struct.go
+++ b/vendor/cuelang.org/go/pkg/struct/struct.go
@@ -16,10 +16,10 @@
 package structs
 
 import (
+	"cuelang.org/go/cue"
 	"cuelang.org/go/cue/errors"
 	"cuelang.org/go/cue/token"
 	"cuelang.org/go/internal/core/adt"
-	"cuelang.org/go/pkg/internal"
 )
 
 // MinFields validates the minimum number of fields that are part of a struct.
@@ -27,19 +27,19 @@ import (
 //
 // Only fields that are part of the data model count. This excludes hidden
 // fields, optional fields, and definitions.
-func MinFields(object internal.Struct, n int) (bool, error) {
-	count := object.Len()
-	code := adt.EvalError
-	if object.IsOpen() {
-		code = adt.IncompleteError
+func MinFields(object *cue.Struct, n int) *adt.Bottom {
+	iter := object.Fields(cue.Hidden(false), cue.Optional(false))
+	count := 0
+	for iter.Next() {
+		count++
 	}
 	if count < n {
-		return false, internal.ValidationError{B: &adt.Bottom{
-			Code: code,
+		return &adt.Bottom{
+			Code: adt.IncompleteError, // could still be resolved
 			Err:  errors.Newf(token.NoPos, "len(fields) < MinFields(%[2]d) (%[1]d < %[2]d)", count, n),
-		}}
+		}
 	}
-	return true, nil
+	return nil
 }
 
 // MaxFields validates the maximum number of fields that are part of a struct.
@@ -47,14 +47,12 @@ func MinFields(object internal.Struct, n int) (bool, error) {
 //
 // Only fields that are part of the data model count. This excludes hidden
 // fields, optional fields, and definitions.
-func MaxFields(object internal.Struct, n int) (bool, error) {
-	count := object.Len()
-	if count > n {
-		return false, internal.ValidationError{B: &adt.Bottom{
-			Code: adt.EvalError,
-			Err:  errors.Newf(token.NoPos, "len(fields) > MaxFields(%[2]d) (%[1]d > %[2]d)", count, n),
-		}}
+func MaxFields(object *cue.Struct, n int) (bool, error) {
+	iter := object.Fields(cue.Hidden(false), cue.Optional(false))
+	count := 0
+	for iter.Next() {
+		count++
 	}
-
-	return true, nil
+	// permanent error is okay here.
+	return count <= n, nil
 }
diff --git a/vendor/cuelang.org/go/pkg/text/tabwriter/pkg.go b/vendor/cuelang.org/go/pkg/text/tabwriter/pkg.go
index 88a4006e5..2fd711b84 100644
--- a/vendor/cuelang.org/go/pkg/text/tabwriter/pkg.go
+++ b/vendor/cuelang.org/go/pkg/text/tabwriter/pkg.go
@@ -1,4 +1,7 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../../gen/gen.go
 
 package tabwriter
 
diff --git a/vendor/cuelang.org/go/pkg/text/template/pkg.go b/vendor/cuelang.org/go/pkg/text/template/pkg.go
index db5d324a7..c61f0a7c8 100644
--- a/vendor/cuelang.org/go/pkg/text/template/pkg.go
+++ b/vendor/cuelang.org/go/pkg/text/template/pkg.go
@@ -1,4 +1,7 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../../gen/gen.go
 
 package template
 
diff --git a/vendor/cuelang.org/go/pkg/time/duration.go b/vendor/cuelang.org/go/pkg/time/duration.go
index 3b73d9e8a..eaea99067 100644
--- a/vendor/cuelang.org/go/pkg/time/duration.go
+++ b/vendor/cuelang.org/go/pkg/time/duration.go
@@ -22,14 +22,13 @@ import (
 // to avoid confusion across daylight savings time zone transitions.
 //
 // To count the number of units in a Duration, divide:
-//
 //	second := time.Second
 //	fmt.Print(int64(second/time.Millisecond)) // prints 1000
 //
 // To convert an integer number of units to a Duration, multiply:
-//
 //	seconds := 10
 //	fmt.Print(time.Duration(seconds)*time.Second) // prints 10s
+//
 const (
 	Nanosecond  = 1
 	Microsecond = 1000
diff --git a/vendor/cuelang.org/go/pkg/time/pkg.go b/vendor/cuelang.org/go/pkg/time/pkg.go
index 883639c17..dd7586545 100644
--- a/vendor/cuelang.org/go/pkg/time/pkg.go
+++ b/vendor/cuelang.org/go/pkg/time/pkg.go
@@ -1,4 +1,7 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../gen/gen.go
 
 package time
 
diff --git a/vendor/cuelang.org/go/pkg/time/time.go b/vendor/cuelang.org/go/pkg/time/time.go
index 9cbb34f03..3cb72d6f3 100644
--- a/vendor/cuelang.org/go/pkg/time/time.go
+++ b/vendor/cuelang.org/go/pkg/time/time.go
@@ -25,14 +25,10 @@ import (
 
 // These are predefined layouts for use in Time.Format and time.Parse.
 // The reference time used in the layouts is the specific time:
-//
 //	Mon Jan 2 15:04:05 MST 2006
-//
 // which is Unix time 1136239445. Since MST is GMT-0700,
 // the reference time can be thought of as
-//
 //	01/02 03:04:05PM '06 -0700
-//
 // To define your own format, write down what the reference time would look
 // like formatted your way; see the values of constants like ANSIC,
 // StampMicro or Kitchen for examples. The model is to demonstrate what the
@@ -56,15 +52,12 @@ import (
 // series of digits is parsed as a fractional second.
 //
 // Numeric time zone offsets format as follows:
-//
 //	-0700  ±hhmm
 //	-07:00 ±hh:mm
 //	-07    ±hh
-//
 // Replacing the sign in the format with a Z triggers
 // the ISO 8601 behavior of printing Z instead of an
 // offset for the UTC zone. Thus:
-//
 //	Z0700  Z or ±hhmm
 //	Z07:00 Z or ±hh:mm
 //	Z07    Z or ±hh
@@ -170,9 +163,7 @@ func FormatString(layout, value string) (string, error) {
 // Parse parses a formatted string and returns the time value it represents.
 // The layout defines the format by showing how the reference time,
 // defined to be
-//
 //	Mon Jan 2 15:04:05 -0700 MST 2006
-//
 // would be interpreted if it were the value; it serves as an example of
 // the input format. The same interpretation will then be made to the
 // input string.
diff --git a/vendor/cuelang.org/go/pkg/tool/cli/cli.cue b/vendor/cuelang.org/go/pkg/tool/cli/cli.cue
index 83ce54635..4d7115d9d 100644
--- a/vendor/cuelang.org/go/pkg/tool/cli/cli.cue
+++ b/vendor/cuelang.org/go/pkg/tool/cli/cli.cue
@@ -27,7 +27,7 @@ Print: {
 // Example:
 //     task: ask: cli.Ask({
 //         prompt:   "Are you okay?"
-//         response: bool
+//         repsonse: bool
 //     })
 Ask: {
 	$id: "tool/cli.Ask"
diff --git a/vendor/cuelang.org/go/pkg/tool/cli/cli.go b/vendor/cuelang.org/go/pkg/tool/cli/cli.go
index 3efd7ab17..fbd5c4df4 100644
--- a/vendor/cuelang.org/go/pkg/tool/cli/cli.go
+++ b/vendor/cuelang.org/go/pkg/tool/cli/cli.go
@@ -14,10 +14,11 @@
 
 package cli
 
+//go:generate go run gen.go
+//go:generate gofmt -s -w .
+
 import (
-	"bufio"
 	"fmt"
-	"io"
 	"strings"
 
 	"cuelang.org/go/cue"
@@ -53,17 +54,6 @@ func newAskCmd(v cue.Value) (task.Runner, error) {
 	return &askCmd{}, nil
 }
 
-type oneByteReader struct {
-	r io.Reader
-}
-
-func (r *oneByteReader) Read(p []byte) (int, error) {
-	if len(p) == 0 {
-		return 0, nil
-	}
-	return r.r.Read(p[:1])
-}
-
 func (c *askCmd) Run(ctx *task.Context) (res interface{}, err error) {
 	str := ctx.String("prompt")
 	if ctx.Err != nil {
@@ -73,20 +63,8 @@ func (c *askCmd) Run(ctx *task.Context) (res interface{}, err error) {
 		fmt.Fprint(ctx.Stdout, str+" ")
 	}
 
-	// Roger is convinced that bufio.Scanner will only issue as many reads
-	// as it needs, so that limiting it to one-byte reads should be enough
-	// to not read any bytes after a newline.
-	// This behavior is true today but technically not documented,
-	// so Roger will send a CL to properly document it.
-	//
-	// TODO(mvdan): come back to remove this notice once Roger's CL is
-	// approved, or to rewrite the code if it is rejected.
-	scanner := bufio.NewScanner(&oneByteReader{ctx.Stdin})
 	var response string
-	if scanner.Scan() {
-		response = scanner.Text()
-	}
-	if err := scanner.Err(); err != nil {
+	if _, err := fmt.Scan(&response); err != nil {
 		return nil, err
 	}
 
diff --git a/vendor/cuelang.org/go/pkg/tool/cli/doc.go b/vendor/cuelang.org/go/pkg/tool/cli/doc.go
new file mode 100644
index 000000000..b2e17ee0c
--- /dev/null
+++ b/vendor/cuelang.org/go/pkg/tool/cli/doc.go
@@ -0,0 +1,33 @@
+// Code generated by cue get go. DO NOT EDIT.
+
+// Package cli provides tasks dealing with a console.
+//
+// These are the supported tasks:
+//
+//     // Print sends text to the stdout of the current process.
+//     Print: {
+//     	$id: *"tool/cli.Print" | "print" // for backwards compatibility
+//
+//     	// text is the text to be printed.
+//     	text: string
+//     }
+//
+//     // Ask prompts the current console with a message and waits for input.
+//     //
+//     // Example:
+//     //     task: ask: cli.Ask({
+//     //         prompt:   "Are you okay?"
+//     //         repsonse: bool
+//     //     })
+//     Ask: {
+//     	$id: "tool/cli.Ask"
+//
+//     	// prompt sends this message to the output.
+//     	prompt: string
+//
+//     	// response holds the user's response. If it is a boolean expression it
+//     	// will interpret the answer using textual yes/ no.
+//     	response: string | bool
+//     }
+//
+package cli
diff --git a/vendor/cuelang.org/go/pkg/tool/cli/doc.txt b/vendor/cuelang.org/go/pkg/tool/cli/doc.txt
deleted file mode 100644
index e79722eab..000000000
--- a/vendor/cuelang.org/go/pkg/tool/cli/doc.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-// Package cli provides tasks dealing with a console.
-//
-// These are the supported tasks:
diff --git a/vendor/cuelang.org/go/pkg/tool/cli/pkg.go b/vendor/cuelang.org/go/pkg/tool/cli/pkg.go
index a405b1db1..b464a370f 100644
--- a/vendor/cuelang.org/go/pkg/tool/cli/pkg.go
+++ b/vendor/cuelang.org/go/pkg/tool/cli/pkg.go
@@ -1,34 +1,8 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../../gen/gen.go
 
-// Package cli provides tasks dealing with a console.
-//
-// These are the supported tasks:
-//
-//	// Print sends text to the stdout of the current process.
-//	Print: {
-//		$id: *"tool/cli.Print" | "print" // for backwards compatibility
-//
-//		// text is the text to be printed.
-//		text: string
-//	}
-//
-//	// Ask prompts the current console with a message and waits for input.
-//	//
-//	// Example:
-//	//     task: ask: cli.Ask({
-//	//         prompt:   "Are you okay?"
-//	//         response: bool
-//	//     })
-//	Ask: {
-//		$id: "tool/cli.Ask"
-//
-//		// prompt sends this message to the output.
-//		prompt: string
-//
-//		// response holds the user's response. If it is a boolean expression it
-//		// will interpret the answer using textual yes/ no.
-//		response: string | bool
-//	}
 package cli
 
 import (
diff --git a/vendor/cuelang.org/go/pkg/tool/doc.go b/vendor/cuelang.org/go/pkg/tool/doc.go
new file mode 100644
index 000000000..6475f977f
--- /dev/null
+++ b/vendor/cuelang.org/go/pkg/tool/doc.go
@@ -0,0 +1,87 @@
+// Code generated by cue get go. DO NOT EDIT.
+
+// Package tool defines statefull operation types for cue commands.
+//
+// This package is only visible in cue files with a _tool.cue or _tool_test.cue
+// ending.
+//
+// CUE configuration files are not influenced by and do not influence anything
+// outside the configuration itself: they are hermetic. Tools solve
+// two problems: allow outside values such as environment variables,
+// file or web contents, random generators etc. to influence configuration,
+// and allow configuration to be actionable from within the tooling itself.
+// Separating these concerns makes it clear to user when outside influences are
+// in play and the tool definition can be strict about what is allowed.
+//
+// Tools are defined in files ending with _tool.cue. These files have a
+// top-level map, "command", which defines all the tools made available through
+// the cue command.
+//
+// The following definitions are for defining commands in tool files:
+//
+//     // A Command specifies a user-defined command.
+//     //
+//     // Descriptions are derived from the doc comment, if they are not provided
+//     // structurally, using the following format:
+//     //
+//     //    // short description on one line
+//     //    //
+//     //    // Usage: <name> usage (optional)
+//     //    //
+//     //    // long description covering the remainder of the doc comment.
+//     //
+//     Command: {
+//     	// Tasks specifies the things to run to complete a command. Tasks are
+//     	// typically underspecified and completed by the particular internal
+//     	// handler that is running them. Tasks can be a single task, or a full
+//     	// hierarchy of tasks.
+//     	//
+//     	// Tasks that depend on the output of other tasks are run after such tasks.
+//     	// Use `$after` if a task needs to run after another task but does not
+//     	// otherwise depend on its output.
+//     	Tasks
+//
+//     	//
+//     	// Example:
+//     	//     mycmd [-n] names
+//     	$usage?: string
+//
+//     	// short is short description of what the command does.
+//     	$short?: string
+//
+//     	// long is a longer description that spans multiple lines and
+//     	// likely contain examples of usage of the command.
+//     	$long?: string
+//     }
+//
+//     // TODO:
+//     // - child commands?
+//
+//     // Tasks defines a hierarchy of tasks. A command completes if all tasks have
+//     // run to completion.
+//     Tasks: Task | {
+//     	[name=Name]: Tasks
+//     }
+//
+//     // #Name defines a valid task or command name.
+//     Name: =~#"^\PL([-](\PL|\PN))*$"#
+//
+//     // A Task defines a step in the execution of a command.
+//     Task: {
+//     	$type: "tool.Task" // legacy field 'kind' still supported for now.
+//
+//     	// kind indicates the operation to run. It must be of the form
+//     	// packagePath.Operation.
+//     	$id: =~#"\."#
+//
+//     	// $after can be used to specify a task is run after another one, when
+//     	// it does not otherwise refer to an output of that task.
+//     	$after?: Task | [...Task]
+//     }
+//
+//     // TODO: consider these options:
+//     //   $success: bool
+//     //   $runif: a.b.$success or $guard: a.b.$success
+//     // With this `$after: a.b` would just be a shorthand for `$guard: a.b.$success`.
+//
+package tool
diff --git a/vendor/cuelang.org/go/pkg/tool/doc.txt b/vendor/cuelang.org/go/pkg/tool/doc.txt
deleted file mode 100644
index 3e861399e..000000000
--- a/vendor/cuelang.org/go/pkg/tool/doc.txt
+++ /dev/null
@@ -1,18 +0,0 @@
-// Package tool defines stateful operation types for cue commands.
-//
-// This package is only visible in cue files with a _tool.cue or _tool_test.cue
-// ending.
-//
-// CUE configuration files are not influenced by and do not influence anything
-// outside the configuration itself: they are hermetic. Tools solve
-// two problems: allow outside values such as environment variables,
-// file or web contents, random generators etc. to influence configuration,
-// and allow configuration to be actionable from within the tooling itself.
-// Separating these concerns makes it clear to user when outside influences are
-// in play and the tool definition can be strict about what is allowed.
-//
-// Tools are defined in files ending with _tool.cue. These files have a
-// top-level map, "command", which defines all the tools made available through
-// the cue command.
-//
-// The following definitions are for defining commands in tool files:
diff --git a/vendor/cuelang.org/go/pkg/tool/exec/doc.go b/vendor/cuelang.org/go/pkg/tool/exec/doc.go
new file mode 100644
index 000000000..ef4e88a73
--- /dev/null
+++ b/vendor/cuelang.org/go/pkg/tool/exec/doc.go
@@ -0,0 +1,43 @@
+// Code generated by cue get go. DO NOT EDIT.
+
+// Package exec defines tasks for running commands.
+//
+// These are the supported tasks:
+//
+//     // Run executes the given shell command.
+//     Run: {
+//     	$id: *"tool/exec.Run" | "exec" // exec for backwards compatibility
+//
+//     	// cmd is the command to run.
+//     	cmd: string | [string, ...string]
+//
+//     	// dir specifies the working directory of the command.
+//     	// The default is the current working directory.
+//     	dir?: string
+//
+//     	// env defines the environment variables to use for this system.
+//     	// If the value is a list, the entries mus be of the form key=value,
+//     	// where the last value takes precendence in the case of multiple
+//     	// occurrances of the same key.
+//     	env: [string]: string | [...=~"="]
+//
+//     	// stdout captures the output from stdout if it is of type bytes or string.
+//     	// The default value of null indicates it is redirected to the stdout of the
+//     	// current process.
+//     	stdout: *null | string | bytes
+//
+//     	// stderr is like stdout, but for errors.
+//     	stderr: *null | string | bytes
+//
+//     	// stdin specifies the input for the process. If stdin is null, the stdin
+//     	// of the current process is redirected to this command (the default).
+//     	// If it is of typ bytes or string, that input will be used instead.
+//     	stdin: *null | string | bytes
+//
+//     	// success is set to true when the process terminates with with a zero exit
+//     	// code or false otherwise. The user can explicitly specify the value
+//     	// force a fatal error if the desired success code is not reached.
+//     	success: bool
+//     }
+//
+package exec
diff --git a/vendor/cuelang.org/go/pkg/tool/exec/doc.txt b/vendor/cuelang.org/go/pkg/tool/exec/doc.txt
deleted file mode 100644
index 1ddb6652d..000000000
--- a/vendor/cuelang.org/go/pkg/tool/exec/doc.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-// Package exec defines tasks for running commands.
-//
-// These are the supported tasks:
diff --git a/vendor/cuelang.org/go/pkg/tool/exec/exec.go b/vendor/cuelang.org/go/pkg/tool/exec/exec.go
index 2559b1c34..2145f14ca 100644
--- a/vendor/cuelang.org/go/pkg/tool/exec/exec.go
+++ b/vendor/cuelang.org/go/pkg/tool/exec/exec.go
@@ -14,6 +14,9 @@
 
 package exec
 
+//go:generate go run gen.go
+//go:generate gofmt -s -w .
+
 import (
 	"fmt"
 	"os/exec"
diff --git a/vendor/cuelang.org/go/pkg/tool/exec/pkg.go b/vendor/cuelang.org/go/pkg/tool/exec/pkg.go
index 027c2df9f..7150b0c25 100644
--- a/vendor/cuelang.org/go/pkg/tool/exec/pkg.go
+++ b/vendor/cuelang.org/go/pkg/tool/exec/pkg.go
@@ -1,44 +1,8 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../../gen/gen.go
 
-// Package exec defines tasks for running commands.
-//
-// These are the supported tasks:
-//
-//	// Run executes the given shell command.
-//	Run: {
-//		$id: *"tool/exec.Run" | "exec" // exec for backwards compatibility
-//
-//		// cmd is the command to run.
-//		cmd: string | [string, ...string]
-//
-//		// dir specifies the working directory of the command.
-//		// The default is the current working directory.
-//		dir?: string
-//
-//		// env defines the environment variables to use for this system.
-//		// If the value is a list, the entries mus be of the form key=value,
-//		// where the last value takes precendence in the case of multiple
-//		// occurrances of the same key.
-//		env: [string]: string | [...=~"="]
-//
-//		// stdout captures the output from stdout if it is of type bytes or string.
-//		// The default value of null indicates it is redirected to the stdout of the
-//		// current process.
-//		stdout: *null | string | bytes
-//
-//		// stderr is like stdout, but for errors.
-//		stderr: *null | string | bytes
-//
-//		// stdin specifies the input for the process. If stdin is null, the stdin
-//		// of the current process is redirected to this command (the default).
-//		// If it is of typ bytes or string, that input will be used instead.
-//		stdin: *null | string | bytes
-//
-//		// success is set to true when the process terminates with with a zero exit
-//		// code or false otherwise. The user can explicitly specify the value
-//		// force a fatal error if the desired success code is not reached.
-//		success: bool
-//	}
 package exec
 
 import (
diff --git a/vendor/cuelang.org/go/pkg/tool/file/doc.go b/vendor/cuelang.org/go/pkg/tool/file/doc.go
new file mode 100644
index 000000000..3807aac1b
--- /dev/null
+++ b/vendor/cuelang.org/go/pkg/tool/file/doc.go
@@ -0,0 +1,128 @@
+// Code generated by cue get go. DO NOT EDIT.
+
+// Package file provides file operations for cue tasks.
+//
+// These are the supported tasks:
+//
+//     // Read reads the contents of a file.
+//     Read: {
+//     	$id: "tool/file.Read"
+//
+//     	// filename names the file to read.
+//     	//
+//     	// Relative names are taken relative to the current working directory.
+//     	// Slashes are converted to the native OS path separator.
+//     	filename: !=""
+//
+//     	// contents is the read contents. If the contents are constraint to bytes
+//     	// (the default), the file is read as is. If it is constraint to a string,
+//     	// the contents are checked to be valid UTF-8.
+//     	contents: *bytes | string
+//     }
+//
+//     // Append writes contents to the given file.
+//     Append: {
+//     	$id: "tool/file.Append"
+//
+//     	// filename names the file to append.
+//     	//
+//     	// Relative names are taken relative to the current working directory.
+//     	// Slashes are converted to the native OS path separator.
+//     	filename: !=""
+//
+//     	// permissions defines the permissions to use if the file does not yet exist.
+//     	permissions: int | *0o666
+//
+//     	// contents specifies the bytes to be written.
+//     	contents: bytes | string
+//     }
+//
+//     // Create writes contents to the given file.
+//     Create: {
+//     	$id: "tool/file.Create"
+//
+//     	// filename names the file to write.
+//     	//
+//     	// Relative names are taken relative to the current working directory.
+//     	// Slashes are converted to the native OS path separator.
+//     	filename: !=""
+//
+//     	// permissions defines the permissions to use if the file does not yet exist.
+//     	permissions: int | *0o666
+//
+//     	// contents specifies the bytes to be written.
+//     	contents: bytes | string
+//     }
+//
+//     // Glob returns a list of files.
+//     Glob: {
+//     	$id: "tool/file.Glob"
+//
+//     	// glob specifies the pattern to match files with.
+//     	//
+//     	// A relative pattern is taken relative to the current working directory.
+//     	// Slashes are converted to the native OS path separator.
+//     	glob: !=""
+//     	files: [...string]
+//     }
+//
+//     // Mkdir creates a directory at the specified path.
+//     Mkdir: {
+//     	$id: "tool/file.Mkdir"
+//
+//     	// The directory path to create.
+//     	// If path is already a directory, Mkdir does nothing.
+//     	// If path already exists and is not a directory, Mkdir will return an error.
+//     	path: string
+//
+//     	// When true any necessary parents are created as well.
+//     	createParents: bool | *false
+//
+//     	// Directory mode and permission bits (before umask).
+//     	permissions: int | *0o755
+//     }
+//
+//     // MkdirAll creates a directory at the specified path along with any necessary
+//     // parents.
+//     // If path is already a directory, MkdirAll does nothing.
+//     // If path already exists and is not a directory, MkdirAll will return an error.
+//     MkdirAll: Mkdir & {
+//     	createParents: true
+//     }
+//
+//     // MkdirTemp creates a new temporary directory in the directory dir and sets
+//     // the pathname of the new directory in path.
+//     // It is the caller's responsibility to remove the directory when it is no
+//     // longer needed.
+//     MkdirTemp: {
+//     	$id: "tool/file.MkdirTemp"
+//
+//     	// The temporary directory is created in the directory specified by dir.
+//     	// If dir is the empty string, MkdirTemp uses the default directory for
+//     	// temporary files.
+//     	dir: string | *""
+//
+//     	// The directory name is generated by adding a random string to the end of pattern.
+//     	// If pattern includes a "*", the random string replaces the last "*" instead.
+//     	pattern: string | *""
+//
+//     	// The absolute path of the created directory.
+//     	path: string
+//     }
+//
+//     // RemoveAll removes path and any children it contains.
+//     // It removes everything it can but returns the first error it encounters.
+//     RemoveAll: {
+//     	$id: "tool/file.RemoveAll"
+//
+//     	// The path to remove.
+//     	// If the path does not exist, RemoveAll does nothing.
+//     	path: string
+//
+//     	// success contains the status of the removal.
+//     	// If path was removed success is set to true.
+//     	// If path didn't exists success is set to false.
+//     	success: bool
+//     }
+//
+package file
diff --git a/vendor/cuelang.org/go/pkg/tool/file/doc.txt b/vendor/cuelang.org/go/pkg/tool/file/doc.txt
deleted file mode 100644
index cc0026fbd..000000000
--- a/vendor/cuelang.org/go/pkg/tool/file/doc.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-// Package file provides file operations for cue tasks.
-//
-// These are the supported tasks:
diff --git a/vendor/cuelang.org/go/pkg/tool/file/file.go b/vendor/cuelang.org/go/pkg/tool/file/file.go
index 740dcbb36..5f865f47b 100644
--- a/vendor/cuelang.org/go/pkg/tool/file/file.go
+++ b/vendor/cuelang.org/go/pkg/tool/file/file.go
@@ -14,6 +14,9 @@
 
 package file
 
+//go:generate go run gen.go
+//go:generate gofmt -s -w .
+
 import (
 	"io/ioutil"
 	"os"
diff --git a/vendor/cuelang.org/go/pkg/tool/file/pkg.go b/vendor/cuelang.org/go/pkg/tool/file/pkg.go
index 2d0f78efc..1f9aea780 100644
--- a/vendor/cuelang.org/go/pkg/tool/file/pkg.go
+++ b/vendor/cuelang.org/go/pkg/tool/file/pkg.go
@@ -1,129 +1,8 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../../gen/gen.go
 
-// Package file provides file operations for cue tasks.
-//
-// These are the supported tasks:
-//
-//	// Read reads the contents of a file.
-//	Read: {
-//		$id: "tool/file.Read"
-//
-//		// filename names the file to read.
-//		//
-//		// Relative names are taken relative to the current working directory.
-//		// Slashes are converted to the native OS path separator.
-//		filename: !=""
-//
-//		// contents is the read contents. If the contents are constraint to bytes
-//		// (the default), the file is read as is. If it is constraint to a string,
-//		// the contents are checked to be valid UTF-8.
-//		contents: *bytes | string
-//	}
-//
-//	// Append writes contents to the given file.
-//	Append: {
-//		$id: "tool/file.Append"
-//
-//		// filename names the file to append.
-//		//
-//		// Relative names are taken relative to the current working directory.
-//		// Slashes are converted to the native OS path separator.
-//		filename: !=""
-//
-//		// permissions defines the permissions to use if the file does not yet exist.
-//		permissions: int | *0o666
-//
-//		// contents specifies the bytes to be written.
-//		contents: bytes | string
-//	}
-//
-//	// Create writes contents to the given file.
-//	Create: {
-//		$id: "tool/file.Create"
-//
-//		// filename names the file to write.
-//		//
-//		// Relative names are taken relative to the current working directory.
-//		// Slashes are converted to the native OS path separator.
-//		filename: !=""
-//
-//		// permissions defines the permissions to use if the file does not yet exist.
-//		permissions: int | *0o666
-//
-//		// contents specifies the bytes to be written.
-//		contents: bytes | string
-//	}
-//
-//	// Glob returns a list of files.
-//	Glob: {
-//		$id: "tool/file.Glob"
-//
-//		// glob specifies the pattern to match files with.
-//		//
-//		// A relative pattern is taken relative to the current working directory.
-//		// Slashes are converted to the native OS path separator.
-//		glob: !=""
-//		files: [...string]
-//	}
-//
-//	// Mkdir creates a directory at the specified path.
-//	Mkdir: {
-//		$id: "tool/file.Mkdir"
-//
-//		// The directory path to create.
-//		// If path is already a directory, Mkdir does nothing.
-//		// If path already exists and is not a directory, Mkdir will return an error.
-//		path: string
-//
-//		// When true any necessary parents are created as well.
-//		createParents: bool | *false
-//
-//		// Directory mode and permission bits (before umask).
-//		permissions: int | *0o755
-//	}
-//
-//	// MkdirAll creates a directory at the specified path along with any necessary
-//	// parents.
-//	// If path is already a directory, MkdirAll does nothing.
-//	// If path already exists and is not a directory, MkdirAll will return an error.
-//	MkdirAll: Mkdir & {
-//		createParents: true
-//	}
-//
-//	// MkdirTemp creates a new temporary directory in the directory dir and sets
-//	// the pathname of the new directory in path.
-//	// It is the caller's responsibility to remove the directory when it is no
-//	// longer needed.
-//	MkdirTemp: {
-//		$id: "tool/file.MkdirTemp"
-//
-//		// The temporary directory is created in the directory specified by dir.
-//		// If dir is the empty string, MkdirTemp uses the default directory for
-//		// temporary files.
-//		dir: string | *""
-//
-//		// The directory name is generated by adding a random string to the end of pattern.
-//		// If pattern includes a "*", the random string replaces the last "*" instead.
-//		pattern: string | *""
-//
-//		// The absolute path of the created directory.
-//		path: string
-//	}
-//
-//	// RemoveAll removes path and any children it contains.
-//	// It removes everything it can but returns the first error it encounters.
-//	RemoveAll: {
-//		$id: "tool/file.RemoveAll"
-//
-//		// The path to remove.
-//		// If the path does not exist, RemoveAll does nothing.
-//		path: string
-//
-//		// success contains the status of the removal.
-//		// If path was removed success is set to true.
-//		// If path didn't exists success is set to false.
-//		success: bool
-//	}
 package file
 
 import (
diff --git a/vendor/cuelang.org/go/pkg/tool/generate.go b/vendor/cuelang.org/go/pkg/tool/generate.go
new file mode 100644
index 000000000..0e16bb7e0
--- /dev/null
+++ b/vendor/cuelang.org/go/pkg/tool/generate.go
@@ -0,0 +1,18 @@
+// Copyright 2019 CUE Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package tool
+
+//go:generate go run gen.go
+//go:generate go fmt
diff --git a/vendor/cuelang.org/go/pkg/tool/http/doc.go b/vendor/cuelang.org/go/pkg/tool/http/doc.go
new file mode 100644
index 000000000..0884f0fa1
--- /dev/null
+++ b/vendor/cuelang.org/go/pkg/tool/http/doc.go
@@ -0,0 +1,53 @@
+// Code generated by cue get go. DO NOT EDIT.
+
+// Package http provides tasks related to the HTTP protocol.
+//
+// These are the supported tasks:
+//
+//     Get:    Do & {method: "GET"}
+//     Post:   Do & {method: "POST"}
+//     Put:    Do & {method: "PUT"}
+//     Delete: Do & {method: "DELETE"}
+//
+//     Do: {
+//     	$id: *"tool/http.Do" | "http" // http for backwards compatibility
+//
+//     	method: string
+//     	url:    string // TODO: make url.URL type
+//
+//     	tls: {
+//     		// Whether the server certificate must be validated.
+//     		verify: *true | bool
+//     		// PEM encoded certificate(s) to validate the server certificate.
+//     		// If not set the CA bundle of the system is used.
+//     		caCert?: bytes | string
+//     	}
+//
+//     	request: {
+//     		body?: bytes | string
+//     		header: [string]:  string | [...string]
+//     		trailer: [string]: string | [...string]
+//     	}
+//     	response: {
+//     		status:     string
+//     		statusCode: int
+//
+//     		body: *bytes | string
+//     		header: [string]:  string | [...string]
+//     		trailer: [string]: string | [...string]
+//     	}
+//     }
+//
+//     //  TODO: support serving once we have the cue serve command.
+//     // Serve: {
+//     //  port: int
+//     //
+//     //  cert: string
+//     //  key:  string
+//     //
+//     //  handle: [Pattern=string]: Message & {
+//     //   pattern: Pattern
+//     //  }
+//     // }
+//
+package http
diff --git a/vendor/cuelang.org/go/pkg/tool/http/doc.txt b/vendor/cuelang.org/go/pkg/tool/http/doc.txt
deleted file mode 100644
index e5b65b6e8..000000000
--- a/vendor/cuelang.org/go/pkg/tool/http/doc.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-// Package http provides tasks related to the HTTP protocol.
-//
-// These are the supported tasks:
diff --git a/vendor/cuelang.org/go/pkg/tool/http/http.go b/vendor/cuelang.org/go/pkg/tool/http/http.go
index 10b5c0439..f30ec6c57 100644
--- a/vendor/cuelang.org/go/pkg/tool/http/http.go
+++ b/vendor/cuelang.org/go/pkg/tool/http/http.go
@@ -14,6 +14,9 @@
 
 package http
 
+//go:generate go run gen.go
+//go:generate gofmt -s -w .
+
 import (
 	"bytes"
 	"crypto/tls"
diff --git a/vendor/cuelang.org/go/pkg/tool/http/pkg.go b/vendor/cuelang.org/go/pkg/tool/http/pkg.go
index dd725d9e6..3b8b4e710 100644
--- a/vendor/cuelang.org/go/pkg/tool/http/pkg.go
+++ b/vendor/cuelang.org/go/pkg/tool/http/pkg.go
@@ -1,54 +1,8 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../../gen/gen.go
 
-// Package http provides tasks related to the HTTP protocol.
-//
-// These are the supported tasks:
-//
-//	Get:    Do & {method: "GET"}
-//	Post:   Do & {method: "POST"}
-//	Put:    Do & {method: "PUT"}
-//	Delete: Do & {method: "DELETE"}
-//
-//	Do: {
-//		$id: *"tool/http.Do" | "http" // http for backwards compatibility
-//
-//		method: string
-//		url:    string // TODO: make url.URL type
-//
-//		tls: {
-//			// Whether the server certificate must be validated.
-//			verify: *true | bool
-//			// PEM encoded certificate(s) to validate the server certificate.
-//			// If not set the CA bundle of the system is used.
-//			caCert?: bytes | string
-//		}
-//
-//		request: {
-//			body?: bytes | string
-//			header: [string]:  string | [...string]
-//			trailer: [string]: string | [...string]
-//		}
-//		response: {
-//			status:     string
-//			statusCode: int
-//
-//			body: *bytes | string
-//			header: [string]:  string | [...string]
-//			trailer: [string]: string | [...string]
-//		}
-//	}
-//
-//	//  TODO: support serving once we have the cue serve command.
-//	// Serve: {
-//	//  port: int
-//	//
-//	//  cert: string
-//	//  key:  string
-//	//
-//	//  handle: [Pattern=string]: Message & {
-//	//   pattern: Pattern
-//	//  }
-//	// }
 package http
 
 import (
diff --git a/vendor/cuelang.org/go/pkg/tool/os/doc.go b/vendor/cuelang.org/go/pkg/tool/os/doc.go
new file mode 100644
index 000000000..b4a66c188
--- /dev/null
+++ b/vendor/cuelang.org/go/pkg/tool/os/doc.go
@@ -0,0 +1,48 @@
+// Code generated by cue get go. DO NOT EDIT.
+
+// Package os defines tasks for retrieving os-related information.
+//
+// CUE definitions:
+//
+//     // A Value are all possible values allowed in flags.
+//     // A null value unsets an environment variable.
+//     Value: bool | number | *string | null
+//
+//     // Name indicates a valid flag name.
+//     Name: !="" & !~"^[$]"
+//
+//     // Setenv defines a set of command line flags, the values of which will be set
+//     // at run time. The doc comment of the flag is presented to the user in help.
+//     //
+//     // To define a shorthand, define the shorthand as a new flag referring to
+//     // the flag of which it is a shorthand.
+//     Setenv: {
+//         $id: "tool/os.Setenv"
+//
+//         {[Name]: Value}
+//     }
+//
+//     // Getenv gets and parses the specific command line variables.
+//     Getenv: {
+//         $id: "tool/os.Getenv"
+//
+//         {[Name]: Value}
+//     }
+//
+//     // Environ populates a struct with all environment variables.
+//     Environ: {
+//         $id: "tool/os.Environ"
+//
+//         // A map of all populated values.
+//         // Individual entries may be specified ahead of time to enable
+//         // validation and parsing. Values that are marked as required
+//         // will fail the task if they are not found.
+//         {[Name]: Value}
+//     }
+//
+//     // Clearenv clears all environment variables.
+//     Clearenv: {
+//         $id: "tool/os.Clearenv"
+//     }
+//
+package os
diff --git a/vendor/cuelang.org/go/pkg/tool/os/doc.txt b/vendor/cuelang.org/go/pkg/tool/os/doc.txt
deleted file mode 100644
index fa48dc82e..000000000
--- a/vendor/cuelang.org/go/pkg/tool/os/doc.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-// Package os defines tasks for retrieving os-related information.
-//
-// CUE definitions:
diff --git a/vendor/cuelang.org/go/pkg/tool/os/env.go b/vendor/cuelang.org/go/pkg/tool/os/env.go
index e17af299a..0d0a535f0 100644
--- a/vendor/cuelang.org/go/pkg/tool/os/env.go
+++ b/vendor/cuelang.org/go/pkg/tool/os/env.go
@@ -14,6 +14,9 @@
 
 package os
 
+//go:generate go run gen.go
+//go:generate gofmt -s -w .
+
 import (
 	"os"
 	"strings"
diff --git a/vendor/cuelang.org/go/pkg/tool/os/pkg.go b/vendor/cuelang.org/go/pkg/tool/os/pkg.go
index 49afe90cb..f1f404359 100644
--- a/vendor/cuelang.org/go/pkg/tool/os/pkg.go
+++ b/vendor/cuelang.org/go/pkg/tool/os/pkg.go
@@ -1,49 +1,8 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../../gen/gen.go
 
-// Package os defines tasks for retrieving os-related information.
-//
-// CUE definitions:
-//
-//	// A Value are all possible values allowed in flags.
-//	// A null value unsets an environment variable.
-//	Value: bool | number | *string | null
-//
-//	// Name indicates a valid flag name.
-//	Name: !="" & !~"^[$]"
-//
-//	// Setenv defines a set of command line flags, the values of which will be set
-//	// at run time. The doc comment of the flag is presented to the user in help.
-//	//
-//	// To define a shorthand, define the shorthand as a new flag referring to
-//	// the flag of which it is a shorthand.
-//	Setenv: {
-//		$id: "tool/os.Setenv"
-//
-//		{[Name]: Value}
-//	}
-//
-//	// Getenv gets and parses the specific command line variables.
-//	Getenv: {
-//		$id: "tool/os.Getenv"
-//
-//		{[Name]: Value}
-//	}
-//
-//	// Environ populates a struct with all environment variables.
-//	Environ: {
-//		$id: "tool/os.Environ"
-//
-//		// A map of all populated values.
-//		// Individual entries may be specified ahead of time to enable
-//		// validation and parsing. Values that are marked as required
-//		// will fail the task if they are not found.
-//		{[Name]: Value}
-//	}
-//
-//	// Clearenv clears all environment variables.
-//	Clearenv: {
-//		$id: "tool/os.Clearenv"
-//	}
 package os
 
 import (
diff --git a/vendor/cuelang.org/go/pkg/tool/pkg.go b/vendor/cuelang.org/go/pkg/tool/pkg.go
deleted file mode 100644
index d25b2db92..000000000
--- a/vendor/cuelang.org/go/pkg/tool/pkg.go
+++ /dev/null
@@ -1,86 +0,0 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
-
-// Package tool defines stateful operation types for cue commands.
-//
-// This package is only visible in cue files with a _tool.cue or _tool_test.cue
-// ending.
-//
-// CUE configuration files are not influenced by and do not influence anything
-// outside the configuration itself: they are hermetic. Tools solve
-// two problems: allow outside values such as environment variables,
-// file or web contents, random generators etc. to influence configuration,
-// and allow configuration to be actionable from within the tooling itself.
-// Separating these concerns makes it clear to user when outside influences are
-// in play and the tool definition can be strict about what is allowed.
-//
-// Tools are defined in files ending with _tool.cue. These files have a
-// top-level map, "command", which defines all the tools made available through
-// the cue command.
-//
-// The following definitions are for defining commands in tool files:
-//
-//	// A Command specifies a user-defined command.
-//	//
-//	// Descriptions are derived from the doc comment, if they are not provided
-//	// structurally, using the following format:
-//	//
-//	//    // short description on one line
-//	//    //
-//	//    // Usage: <name> usage (optional)
-//	//    //
-//	//    // long description covering the remainder of the doc comment.
-//	//
-//	Command: {
-//		// Tasks specifies the things to run to complete a command. Tasks are
-//		// typically underspecified and completed by the particular internal
-//		// handler that is running them. Tasks can be a single task, or a full
-//		// hierarchy of tasks.
-//		//
-//		// Tasks that depend on the output of other tasks are run after such tasks.
-//		// Use `$after` if a task needs to run after another task but does not
-//		// otherwise depend on its output.
-//		Tasks
-//
-//		//
-//		// Example:
-//		//     mycmd [-n] names
-//		$usage?: string
-//
-//		// short is short description of what the command does.
-//		$short?: string
-//
-//		// long is a longer description that spans multiple lines and
-//		// likely contain examples of usage of the command.
-//		$long?: string
-//	}
-//
-//	// TODO:
-//	// - child commands?
-//
-//	// Tasks defines a hierarchy of tasks. A command completes if all tasks have
-//	// run to completion.
-//	Tasks: Task | {
-//		[name=Name]: Tasks
-//	}
-//
-//	// #Name defines a valid task or command name.
-//	Name: =~#"^\PL([-](\PL|\PN))*$"#
-//
-//	// A Task defines a step in the execution of a command.
-//	Task: {
-//		$type: "tool.Task" // legacy field 'kind' still supported for now.
-//
-//		// kind indicates the operation to run. It must be of the form
-//		// packagePath.Operation.
-//		$id: =~#"\."#
-//
-//		// $after can be used to specify a task is run after another one, when
-//		// it does not otherwise refer to an output of that task.
-//		$after?: Task | [...Task]
-//	}
-//
-//	// TODO: consider these options:
-//	//   $success: bool
-//	//   $runif: a.b.$success or $guard: a.b.$success
-//	// With this `$after: a.b` would just be a shorthand for `$guard: a.b.$success`.
-package tool
diff --git a/vendor/cuelang.org/go/pkg/uuid/pkg.go b/vendor/cuelang.org/go/pkg/uuid/pkg.go
index dc28245b5..ae2be7e79 100644
--- a/vendor/cuelang.org/go/pkg/uuid/pkg.go
+++ b/vendor/cuelang.org/go/pkg/uuid/pkg.go
@@ -1,4 +1,7 @@
-// Code generated by cuelang.org/go/pkg/gen. DO NOT EDIT.
+// Code generated by go generate. DO NOT EDIT.
+
+//go:generate rm pkg.go
+//go:generate go run ../gen/gen.go
 
 package uuid
 
diff --git a/vendor/cuelang.org/go/pkg/uuid/uuid.go b/vendor/cuelang.org/go/pkg/uuid/uuid.go
index 0adce9dc9..9d5551798 100644
--- a/vendor/cuelang.org/go/pkg/uuid/uuid.go
+++ b/vendor/cuelang.org/go/pkg/uuid/uuid.go
@@ -62,7 +62,8 @@ func URN(x string) (string, error) {
 
 // FromInt creates a UUID from an integer.
 //
-//	DNS:  uuid.FromInt(0x6ba7b810_9dad_11d1_80b4_00c04fd430c8)
+//    DNS:  uuid.FromInt(0x6ba7b810_9dad_11d1_80b4_00c04fd430c8)
+//
 func FromInt(i *big.Int) (string, error) {
 	// must be uint128
 	var buf [16]byte
diff --git a/vendor/github.com/99designs/gqlgen/graphql/duration.go b/vendor/github.com/99designs/gqlgen/graphql/duration.go
new file mode 100644
index 000000000..3eb392db8
--- /dev/null
+++ b/vendor/github.com/99designs/gqlgen/graphql/duration.go
@@ -0,0 +1,27 @@
+package graphql
+
+import (
+	"fmt"
+	"time"
+
+	dur "github.com/sosodev/duration"
+)
+
+// UnmarshalDuration returns the duration from a string in ISO8601 format
+func UnmarshalDuration(v interface{}) (time.Duration, error) {
+	input, ok := v.(string)
+	if !ok {
+		return 0, fmt.Errorf("input must be a string")
+	}
+
+	d2, err := dur.Parse(input)
+	if err != nil {
+		return 0, err
+	}
+	return d2.ToTimeDuration(), nil
+}
+
+// MarshalDuration returns the duration on ISO8601 format
+func MarshalDuration(d time.Duration) Marshaler {
+	return MarshalString(dur.Format(d))
+}
diff --git a/vendor/github.com/99designs/gqlgen/graphql/version.go b/vendor/github.com/99designs/gqlgen/graphql/version.go
index a1666bc72..38d27528b 100644
--- a/vendor/github.com/99designs/gqlgen/graphql/version.go
+++ b/vendor/github.com/99designs/gqlgen/graphql/version.go
@@ -1,3 +1,3 @@
 package graphql
 
-const Version = "v0.17.38"
+const Version = "v0.17.39"
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go b/vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go
index c0faf837e..5f97b40a6 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/endpoints/defaults.go
@@ -2572,21 +2572,81 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "fips-us-east-1",
+				}: endpoint{
+					Hostname: "appflow-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-east-2",
+				}: endpoint{
+					Hostname: "appflow-fips.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-west-1",
+				}: endpoint{
+					Hostname: "appflow-fips.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-west-2",
+				}: endpoint{
+					Hostname: "appflow-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+					Deprecated: boxedTrue,
+				},
 				endpointKey{
 					Region: "sa-east-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "us-east-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "appflow-fips.us-east-1.amazonaws.com",
+				},
 				endpointKey{
 					Region: "us-east-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "appflow-fips.us-east-2.amazonaws.com",
+				},
 				endpointKey{
 					Region: "us-west-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "appflow-fips.us-west-1.amazonaws.com",
+				},
 				endpointKey{
 					Region: "us-west-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "appflow-fips.us-west-2.amazonaws.com",
+				},
 			},
 		},
 		"application-autoscaling": service{
@@ -4408,6 +4468,118 @@ var awsPartition = partition{
 				},
 			},
 		},
+		"bedrock": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "ap-northeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "bedrock-ap-northeast-1",
+				}: endpoint{
+					Hostname: "bedrock.ap-northeast-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-northeast-1",
+					},
+				},
+				endpointKey{
+					Region: "bedrock-ap-southeast-1",
+				}: endpoint{
+					Hostname: "bedrock.ap-southeast-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-southeast-1",
+					},
+				},
+				endpointKey{
+					Region: "bedrock-fips-us-east-1",
+				}: endpoint{
+					Hostname: "bedrock-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				endpointKey{
+					Region: "bedrock-fips-us-west-2",
+				}: endpoint{
+					Hostname: "bedrock-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+				endpointKey{
+					Region: "bedrock-runtime-ap-northeast-1",
+				}: endpoint{
+					Hostname: "bedrock-runtime.ap-northeast-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-northeast-1",
+					},
+				},
+				endpointKey{
+					Region: "bedrock-runtime-ap-southeast-1",
+				}: endpoint{
+					Hostname: "bedrock-runtime.ap-southeast-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ap-southeast-1",
+					},
+				},
+				endpointKey{
+					Region: "bedrock-runtime-fips-us-east-1",
+				}: endpoint{
+					Hostname: "bedrock-runtime-fips.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				endpointKey{
+					Region: "bedrock-runtime-fips-us-west-2",
+				}: endpoint{
+					Hostname: "bedrock-runtime-fips.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+				endpointKey{
+					Region: "bedrock-runtime-us-east-1",
+				}: endpoint{
+					Hostname: "bedrock-runtime.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				endpointKey{
+					Region: "bedrock-runtime-us-west-2",
+				}: endpoint{
+					Hostname: "bedrock-runtime.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+				endpointKey{
+					Region: "bedrock-us-east-1",
+				}: endpoint{
+					Hostname: "bedrock.us-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-1",
+					},
+				},
+				endpointKey{
+					Region: "bedrock-us-west-2",
+				}: endpoint{
+					Hostname: "bedrock.us-west-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-2",
+					},
+				},
+				endpointKey{
+					Region: "us-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "us-west-2",
+				}: endpoint{},
+			},
+		},
 		"billingconductor": service{
 			PartitionEndpoint: "aws-global",
 			IsRegionalized:    boxedFalse,
@@ -8007,6 +8179,185 @@ var awsPartition = partition{
 				},
 			},
 		},
+		"datazone": service{
+			Defaults: endpointDefaults{
+				defaultKey{}: endpoint{
+					DNSSuffix: "api.aws",
+				},
+				defaultKey{
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname:  "{service}-fips.{region}.{dnsSuffix}",
+					DNSSuffix: "api.aws",
+				},
+			},
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "af-south-1",
+				}: endpoint{
+					Hostname: "datazone.af-south-1.api.aws",
+				},
+				endpointKey{
+					Region: "ap-east-1",
+				}: endpoint{
+					Hostname: "datazone.ap-east-1.api.aws",
+				},
+				endpointKey{
+					Region: "ap-northeast-1",
+				}: endpoint{
+					Hostname: "datazone.ap-northeast-1.api.aws",
+				},
+				endpointKey{
+					Region: "ap-northeast-2",
+				}: endpoint{
+					Hostname: "datazone.ap-northeast-2.api.aws",
+				},
+				endpointKey{
+					Region: "ap-northeast-3",
+				}: endpoint{
+					Hostname: "datazone.ap-northeast-3.api.aws",
+				},
+				endpointKey{
+					Region: "ap-south-1",
+				}: endpoint{
+					Hostname: "datazone.ap-south-1.api.aws",
+				},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{
+					Hostname: "datazone.ap-south-2.api.aws",
+				},
+				endpointKey{
+					Region: "ap-southeast-1",
+				}: endpoint{
+					Hostname: "datazone.ap-southeast-1.api.aws",
+				},
+				endpointKey{
+					Region: "ap-southeast-2",
+				}: endpoint{
+					Hostname: "datazone.ap-southeast-2.api.aws",
+				},
+				endpointKey{
+					Region: "ap-southeast-3",
+				}: endpoint{
+					Hostname: "datazone.ap-southeast-3.api.aws",
+				},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{
+					Hostname: "datazone.ap-southeast-4.api.aws",
+				},
+				endpointKey{
+					Region: "ca-central-1",
+				}: endpoint{
+					Hostname: "datazone.ca-central-1.api.aws",
+				},
+				endpointKey{
+					Region:  "ca-central-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "datazone-fips.ca-central-1.amazonaws.com",
+				},
+				endpointKey{
+					Region: "eu-central-1",
+				}: endpoint{
+					Hostname: "datazone.eu-central-1.api.aws",
+				},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{
+					Hostname: "datazone.eu-central-2.api.aws",
+				},
+				endpointKey{
+					Region: "eu-north-1",
+				}: endpoint{
+					Hostname: "datazone.eu-north-1.api.aws",
+				},
+				endpointKey{
+					Region: "eu-south-1",
+				}: endpoint{
+					Hostname: "datazone.eu-south-1.api.aws",
+				},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{
+					Hostname: "datazone.eu-south-2.api.aws",
+				},
+				endpointKey{
+					Region: "eu-west-1",
+				}: endpoint{
+					Hostname: "datazone.eu-west-1.api.aws",
+				},
+				endpointKey{
+					Region: "eu-west-2",
+				}: endpoint{
+					Hostname: "datazone.eu-west-2.api.aws",
+				},
+				endpointKey{
+					Region: "eu-west-3",
+				}: endpoint{
+					Hostname: "datazone.eu-west-3.api.aws",
+				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{
+					Hostname: "datazone.il-central-1.api.aws",
+				},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{
+					Hostname: "datazone.me-central-1.api.aws",
+				},
+				endpointKey{
+					Region: "me-south-1",
+				}: endpoint{
+					Hostname: "datazone.me-south-1.api.aws",
+				},
+				endpointKey{
+					Region: "sa-east-1",
+				}: endpoint{
+					Hostname: "datazone.sa-east-1.api.aws",
+				},
+				endpointKey{
+					Region: "us-east-1",
+				}: endpoint{
+					Hostname: "datazone.us-east-1.api.aws",
+				},
+				endpointKey{
+					Region:  "us-east-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "datazone-fips.us-east-1.amazonaws.com",
+				},
+				endpointKey{
+					Region: "us-east-2",
+				}: endpoint{
+					Hostname: "datazone.us-east-2.api.aws",
+				},
+				endpointKey{
+					Region:  "us-east-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "datazone-fips.us-east-2.amazonaws.com",
+				},
+				endpointKey{
+					Region: "us-west-1",
+				}: endpoint{
+					Hostname: "datazone.us-west-1.api.aws",
+				},
+				endpointKey{
+					Region: "us-west-2",
+				}: endpoint{
+					Hostname: "datazone.us-west-2.api.aws",
+				},
+				endpointKey{
+					Region:  "us-west-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "datazone-fips.us-west-2.amazonaws.com",
+				},
+			},
+		},
 		"dax": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -11044,6 +11395,12 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "ca-central-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "email-fips.ca-central-1.amazonaws.com",
+				},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
@@ -11062,6 +11419,15 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "fips-ca-central-1",
+				}: endpoint{
+					Hostname: "email-fips.ca-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "ca-central-1",
+					},
+					Deprecated: boxedTrue,
+				},
 				endpointKey{
 					Region: "fips-us-east-1",
 				}: endpoint{
@@ -11071,6 +11437,24 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "fips-us-east-2",
+				}: endpoint{
+					Hostname: "email-fips.us-east-2.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-east-2",
+					},
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-west-1",
+				}: endpoint{
+					Hostname: "email-fips.us-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-west-1",
+					},
+					Deprecated: boxedTrue,
+				},
 				endpointKey{
 					Region: "fips-us-west-2",
 				}: endpoint{
@@ -11101,9 +11485,21 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "us-east-2",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-east-2",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "email-fips.us-east-2.amazonaws.com",
+				},
 				endpointKey{
 					Region: "us-west-1",
 				}: endpoint{},
+				endpointKey{
+					Region:  "us-west-1",
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname: "email-fips.us-west-1.amazonaws.com",
+				},
 				endpointKey{
 					Region: "us-west-2",
 				}: endpoint{},
@@ -14271,6 +14667,9 @@ var awsPartition = partition{
 		},
 		"inspector2": service{
 			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "af-south-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-east-1",
 				}: endpoint{},
@@ -14280,6 +14679,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-northeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-3",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
@@ -14289,12 +14691,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-3",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
@@ -17339,6 +17747,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -17348,12 +17759,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
@@ -17408,6 +17825,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "il-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "me-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-south-1",
 				}: endpoint{},
@@ -17620,6 +18040,9 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-south-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
@@ -17629,12 +18052,18 @@ var awsPartition = partition{
 				endpointKey{
 					Region: "ap-southeast-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-4",
+				}: endpoint{},
 				endpointKey{
 					Region: "ca-central-1",
 				}: endpoint{},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-central-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-north-1",
 				}: endpoint{},
@@ -18834,12 +19263,30 @@ var awsPartition = partition{
 		},
 		"meetings-chime": service{
 			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "ap-northeast-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-northeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ap-south-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "ap-southeast-2",
+				}: endpoint{},
+				endpointKey{
+					Region: "ca-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-west-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "il-central-1",
 				}: endpoint{},
@@ -20067,6 +20514,9 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "me-central-1",
 				}: endpoint{},
@@ -20519,6 +20969,14 @@ var awsPartition = partition{
 					},
 					Deprecated: boxedTrue,
 				},
+				endpointKey{
+					Region: "il-central-1",
+				}: endpoint{
+					Hostname: "omics.il-central-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "il-central-1",
+					},
+				},
 				endpointKey{
 					Region: "us-east-1",
 				}: endpoint{
@@ -23182,6 +23640,11 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "resource-explorer-2.ap-southeast-2.api.aws",
 				},
+				endpointKey{
+					Region: "ap-southeast-3",
+				}: endpoint{
+					Hostname: "resource-explorer-2.ap-southeast-3.api.aws",
+				},
 				endpointKey{
 					Region: "ap-southeast-4",
 				}: endpoint{
@@ -23227,6 +23690,11 @@ var awsPartition = partition{
 				}: endpoint{
 					Hostname: "resource-explorer-2.il-central-1.api.aws",
 				},
+				endpointKey{
+					Region: "me-south-1",
+				}: endpoint{
+					Hostname: "resource-explorer-2.me-south-1.api.aws",
+				},
 				endpointKey{
 					Region: "sa-east-1",
 				}: endpoint{
@@ -29159,15 +29627,30 @@ var awsPartition = partition{
 		},
 		"tnb": service{
 			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "ap-northeast-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "ap-southeast-2",
 				}: endpoint{},
+				endpointKey{
+					Region: "ca-central-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-central-1",
 				}: endpoint{},
+				endpointKey{
+					Region: "eu-north-1",
+				}: endpoint{},
+				endpointKey{
+					Region: "eu-south-2",
+				}: endpoint{},
 				endpointKey{
 					Region: "eu-west-3",
 				}: endpoint{},
+				endpointKey{
+					Region: "sa-east-1",
+				}: endpoint{},
 				endpointKey{
 					Region: "us-east-1",
 				}: endpoint{},
@@ -32101,6 +32584,20 @@ var awscnPartition = partition{
 				},
 			},
 		},
+		"api.pricing": service{
+			Defaults: endpointDefaults{
+				defaultKey{}: endpoint{
+					CredentialScope: credentialScope{
+						Service: "pricing",
+					},
+				},
+			},
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "cn-northwest-1",
+				}: endpoint{},
+			},
+		},
 		"api.sagemaker": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -32518,6 +33015,31 @@ var awscnPartition = partition{
 				}: endpoint{},
 			},
 		},
+		"datazone": service{
+			Defaults: endpointDefaults{
+				defaultKey{}: endpoint{
+					DNSSuffix: "api.amazonwebservices.com.cn",
+				},
+				defaultKey{
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname:  "{service}-fips.{region}.{dnsSuffix}",
+					DNSSuffix: "api.amazonwebservices.com.cn",
+				},
+			},
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "cn-north-1",
+				}: endpoint{
+					Hostname: "datazone.cn-north-1.api.amazonwebservices.com.cn",
+				},
+				endpointKey{
+					Region: "cn-northwest-1",
+				}: endpoint{
+					Hostname: "datazone.cn-northwest-1.api.amazonwebservices.com.cn",
+				},
+			},
+		},
 		"dax": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -35279,6 +35801,13 @@ var awsusgovPartition = partition{
 				},
 			},
 		},
+		"codestar-connections": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "us-gov-east-1",
+				}: endpoint{},
+			},
+		},
 		"cognito-identity": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -35622,6 +36151,31 @@ var awsusgovPartition = partition{
 				},
 			},
 		},
+		"datazone": service{
+			Defaults: endpointDefaults{
+				defaultKey{}: endpoint{
+					DNSSuffix: "api.aws",
+				},
+				defaultKey{
+					Variant: fipsVariant,
+				}: endpoint{
+					Hostname:  "{service}-fips.{region}.{dnsSuffix}",
+					DNSSuffix: "api.aws",
+				},
+			},
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "us-gov-east-1",
+				}: endpoint{
+					Hostname: "datazone.us-gov-east-1.api.aws",
+				},
+				endpointKey{
+					Region: "us-gov-west-1",
+				}: endpoint{
+					Hostname: "datazone.us-gov-west-1.api.aws",
+				},
+			},
+		},
 		"directconnect": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -37652,6 +38206,36 @@ var awsusgovPartition = partition{
 				},
 			},
 		},
+		"m2": service{
+			Endpoints: serviceEndpoints{
+				endpointKey{
+					Region: "fips-us-gov-east-1",
+				}: endpoint{
+
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "fips-us-gov-west-1",
+				}: endpoint{
+
+					Deprecated: boxedTrue,
+				},
+				endpointKey{
+					Region: "us-gov-east-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-gov-east-1",
+					Variant: fipsVariant,
+				}: endpoint{},
+				endpointKey{
+					Region: "us-gov-west-1",
+				}: endpoint{},
+				endpointKey{
+					Region:  "us-gov-west-1",
+					Variant: fipsVariant,
+				}: endpoint{},
+			},
+		},
 		"managedblockchain": service{
 			Endpoints: serviceEndpoints{
 				endpointKey{
@@ -39247,10 +39831,20 @@ var awsusgovPartition = partition{
 			Endpoints: serviceEndpoints{
 				endpointKey{
 					Region: "us-gov-east-1",
-				}: endpoint{},
+				}: endpoint{
+					Hostname: "simspaceweaver.us-gov-east-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-east-1",
+					},
+				},
 				endpointKey{
 					Region: "us-gov-west-1",
-				}: endpoint{},
+				}: endpoint{
+					Hostname: "simspaceweaver.us-gov-west-1.amazonaws.com",
+					CredentialScope: credentialScope{
+						Region: "us-gov-west-1",
+					},
+				},
 			},
 		},
 		"sms": service{
diff --git a/vendor/github.com/aws/aws-sdk-go/aws/version.go b/vendor/github.com/aws/aws-sdk-go/aws/version.go
index f9673717c..d03e56170 100644
--- a/vendor/github.com/aws/aws-sdk-go/aws/version.go
+++ b/vendor/github.com/aws/aws-sdk-go/aws/version.go
@@ -5,4 +5,4 @@ package aws
 const SDKName = "aws-sdk-go"
 
 // SDKVersion is the version of this SDK
-const SDKVersion = "1.45.16"
+const SDKVersion = "1.45.25"
diff --git a/vendor/github.com/aws/aws-sdk-go/service/s3/api.go b/vendor/github.com/aws/aws-sdk-go/service/s3/api.go
index 188e37fdc..cf17e8299 100644
--- a/vendor/github.com/aws/aws-sdk-go/service/s3/api.go
+++ b/vendor/github.com/aws/aws-sdk-go/service/s3/api.go
@@ -42379,6 +42379,9 @@ const (
 
 	// ReplicationStatusReplica is a ReplicationStatus enum value
 	ReplicationStatusReplica = "REPLICA"
+
+	// ReplicationStatusCompleted is a ReplicationStatus enum value
+	ReplicationStatusCompleted = "COMPLETED"
 )
 
 // ReplicationStatus_Values returns all elements of the ReplicationStatus enum
@@ -42388,6 +42391,7 @@ func ReplicationStatus_Values() []string {
 		ReplicationStatusPending,
 		ReplicationStatusFailed,
 		ReplicationStatusReplica,
+		ReplicationStatusCompleted,
 	}
 }
 
diff --git a/vendor/github.com/charmbracelet/lipgloss/README.md b/vendor/github.com/charmbracelet/lipgloss/README.md
index 2ebabc764..f3aa745a6 100644
--- a/vendor/github.com/charmbracelet/lipgloss/README.md
+++ b/vendor/github.com/charmbracelet/lipgloss/README.md
@@ -391,7 +391,6 @@ height := lipgloss.Height(block)
 w, h := lipgloss.Size(block)
 ```
 
-
 ### Placing Text in Whitespace
 
 Sometimes you’ll simply want to place a block of text in whitespace.
@@ -411,6 +410,58 @@ block := lipgloss.Place(30, 80, lipgloss.Right, lipgloss.Bottom, fancyStyledPara
 
 You can also style the whitespace. For details, see [the docs][docs].
 
+### Rendering Tables
+
+Lip Gloss ships with a table rendering sub-package.
+
+```go
+import "github.com/charmbracelet/lipgloss/table"
+```
+
+Define some rows of data.
+
+```go
+rows := [][]string{
+    {"Chinese", "您好", "你好"},
+    {"Japanese", "こんにちは", "やあ"},
+    {"Arabic", "أهلين", "أهلا"},
+    {"Russian", "Здравствуйте", "Привет"},
+    {"Spanish", "Hola", "¿Qué tal?"},
+}
+```
+
+Use the table package to style and render the table.
+
+```go
+t := table.New().
+    Border(lipgloss.NormalBorder()).
+    BorderStyle(lipgloss.NewStyle().Foreground(lipgloss.Color("99"))).
+    StyleFunc(func(row, col int) lipgloss.Style {
+        switch {
+        case row == 0:
+            return HeaderStyle
+        case row%2 == 0:
+            return EvenRowStyle
+        default:
+            return OddRowStyle
+        }
+    }).
+    Headers("LANGUAGE", "FORMAL", "INFORMAL").
+    Rows(rows...)
+
+// You can also add tables row-by-row
+t.Row("English", "You look absolutely fabulous.", "How's it going?")
+```
+
+Print the table.
+
+```go
+fmt.Println(t)
+```
+
+![Table Example](https://github.com/charmbracelet/lipgloss/assets/42545625/6e4b70c4-f494-45da-a467-bdd27df30d5d)
+
+For more on tables see [the docs](https://pkg.go.dev/github.com/charmbracelet/lipgloss?tab=doc).
 
 ***
 
diff --git a/vendor/github.com/charmbracelet/lipgloss/borders.go b/vendor/github.com/charmbracelet/lipgloss/borders.go
index 2c4931616..f244b53a5 100644
--- a/vendor/github.com/charmbracelet/lipgloss/borders.go
+++ b/vendor/github.com/charmbracelet/lipgloss/borders.go
@@ -11,14 +11,19 @@ import (
 // Border contains a series of values which comprise the various parts of a
 // border.
 type Border struct {
-	Top         string
-	Bottom      string
-	Left        string
-	Right       string
-	TopLeft     string
-	TopRight    string
-	BottomRight string
-	BottomLeft  string
+	Top          string
+	Bottom       string
+	Left         string
+	Right        string
+	TopLeft      string
+	TopRight     string
+	BottomLeft   string
+	BottomRight  string
+	MiddleLeft   string
+	MiddleRight  string
+	Middle       string
+	MiddleTop    string
+	MiddleBottom string
 }
 
 // GetTopSize returns the width of the top border. If borders contain runes of
@@ -63,25 +68,35 @@ var (
 	noBorder = Border{}
 
 	normalBorder = Border{
-		Top:         "─",
-		Bottom:      "─",
-		Left:        "│",
-		Right:       "│",
-		TopLeft:     "┌",
-		TopRight:    "┐",
-		BottomLeft:  "└",
-		BottomRight: "┘",
+		Top:          "─",
+		Bottom:       "─",
+		Left:         "│",
+		Right:        "│",
+		TopLeft:      "┌",
+		TopRight:     "┐",
+		BottomLeft:   "└",
+		BottomRight:  "┘",
+		MiddleLeft:   "├",
+		MiddleRight:  "┤",
+		Middle:       "┼",
+		MiddleTop:    "┬",
+		MiddleBottom: "┴",
 	}
 
 	roundedBorder = Border{
-		Top:         "─",
-		Bottom:      "─",
-		Left:        "│",
-		Right:       "│",
-		TopLeft:     "╭",
-		TopRight:    "╮",
-		BottomLeft:  "╰",
-		BottomRight: "╯",
+		Top:          "─",
+		Bottom:       "─",
+		Left:         "│",
+		Right:        "│",
+		TopLeft:      "╭",
+		TopRight:     "╮",
+		BottomLeft:   "╰",
+		BottomRight:  "╯",
+		MiddleLeft:   "├",
+		MiddleRight:  "┤",
+		Middle:       "┼",
+		MiddleTop:    "┬",
+		MiddleBottom: "┴",
 	}
 
 	blockBorder = Border{
@@ -118,36 +133,51 @@ var (
 	}
 
 	thickBorder = Border{
-		Top:         "━",
-		Bottom:      "━",
-		Left:        "┃",
-		Right:       "┃",
-		TopLeft:     "┏",
-		TopRight:    "┓",
-		BottomLeft:  "┗",
-		BottomRight: "┛",
+		Top:          "━",
+		Bottom:       "━",
+		Left:         "┃",
+		Right:        "┃",
+		TopLeft:      "┏",
+		TopRight:     "┓",
+		BottomLeft:   "┗",
+		BottomRight:  "┛",
+		MiddleLeft:   "┣",
+		MiddleRight:  "┫",
+		Middle:       "╋",
+		MiddleTop:    "┳",
+		MiddleBottom: "┻",
 	}
 
 	doubleBorder = Border{
-		Top:         "═",
-		Bottom:      "═",
-		Left:        "║",
-		Right:       "║",
-		TopLeft:     "╔",
-		TopRight:    "╗",
-		BottomLeft:  "╚",
-		BottomRight: "╝",
+		Top:          "═",
+		Bottom:       "═",
+		Left:         "║",
+		Right:        "║",
+		TopLeft:      "╔",
+		TopRight:     "╗",
+		BottomLeft:   "╚",
+		BottomRight:  "╝",
+		MiddleLeft:   "╠",
+		MiddleRight:  "╣",
+		Middle:       "╬",
+		MiddleTop:    "╦",
+		MiddleBottom: "╩",
 	}
 
 	hiddenBorder = Border{
-		Top:         " ",
-		Bottom:      " ",
-		Left:        " ",
-		Right:       " ",
-		TopLeft:     " ",
-		TopRight:    " ",
-		BottomLeft:  " ",
-		BottomRight: " ",
+		Top:          " ",
+		Bottom:       " ",
+		Left:         " ",
+		Right:        " ",
+		TopLeft:      " ",
+		TopRight:     " ",
+		BottomLeft:   " ",
+		BottomRight:  " ",
+		MiddleLeft:   " ",
+		MiddleRight:  " ",
+		Middle:       " ",
+		MiddleTop:    " ",
+		MiddleBottom: " ",
 	}
 )
 
diff --git a/vendor/github.com/charmbracelet/lipgloss/get.go b/vendor/github.com/charmbracelet/lipgloss/get.go
index d0f0826ea..d2623c4ef 100644
--- a/vendor/github.com/charmbracelet/lipgloss/get.go
+++ b/vendor/github.com/charmbracelet/lipgloss/get.go
@@ -333,23 +333,21 @@ func (s Style) GetBorderRightSize() int {
 	if !s.getAsBool(borderRightKey, false) {
 		return 0
 	}
-	return s.getBorderStyle().GetBottomSize()
+	return s.getBorderStyle().GetRightSize()
 }
 
 // GetHorizontalBorderSize returns the width of the horizontal borders. If
 // borders contain runes of varying widths, the widest rune is returned. If no
 // border exists on the horizontal edges, 0 is returned.
 func (s Style) GetHorizontalBorderSize() int {
-	b := s.getBorderStyle()
-	return b.GetLeftSize() + b.GetRightSize()
+	return s.GetBorderLeftSize() + s.GetBorderRightSize()
 }
 
 // GetVerticalBorderSize returns the width of the vertical borders. If
 // borders contain runes of varying widths, the widest rune is returned. If no
 // border exists on the vertical edges, 0 is returned.
 func (s Style) GetVerticalBorderSize() int {
-	b := s.getBorderStyle()
-	return b.GetTopSize() + b.GetBottomSize()
+	return s.GetBorderTopSize() + s.GetBorderBottomSize()
 }
 
 // GetInline returns the style's inline setting. If no value is set false is
diff --git a/vendor/github.com/charmbracelet/lipgloss/unset.go b/vendor/github.com/charmbracelet/lipgloss/unset.go
index f889f9e2d..770734c82 100644
--- a/vendor/github.com/charmbracelet/lipgloss/unset.go
+++ b/vendor/github.com/charmbracelet/lipgloss/unset.go
@@ -287,7 +287,7 @@ func (s Style) UnsetMaxHeight() Style {
 	return s
 }
 
-// UnsetMaxHeight removes the max height style rule, if set.
+// UnsetTabWidth removes the tab width style rule, if set.
 func (s Style) UnsetTabWidth() Style {
 	delete(s.rules, tabWidthKey)
 	return s
diff --git a/vendor/github.com/cpuguy83/go-md2man/v2/md2man/md2man.go b/vendor/github.com/cpuguy83/go-md2man/v2/md2man/md2man.go
index b48005673..42bf32aab 100644
--- a/vendor/github.com/cpuguy83/go-md2man/v2/md2man/md2man.go
+++ b/vendor/github.com/cpuguy83/go-md2man/v2/md2man/md2man.go
@@ -9,6 +9,8 @@ func Render(doc []byte) []byte {
 	renderer := NewRoffRenderer()
 
 	return blackfriday.Run(doc,
-		[]blackfriday.Option{blackfriday.WithRenderer(renderer),
-			blackfriday.WithExtensions(renderer.GetExtensions())}...)
+		[]blackfriday.Option{
+			blackfriday.WithRenderer(renderer),
+			blackfriday.WithExtensions(renderer.GetExtensions()),
+		}...)
 }
diff --git a/vendor/github.com/cpuguy83/go-md2man/v2/md2man/roff.go b/vendor/github.com/cpuguy83/go-md2man/v2/md2man/roff.go
index be2b34360..4b19188d9 100644
--- a/vendor/github.com/cpuguy83/go-md2man/v2/md2man/roff.go
+++ b/vendor/github.com/cpuguy83/go-md2man/v2/md2man/roff.go
@@ -1,6 +1,7 @@
 package md2man
 
 import (
+	"bytes"
 	"fmt"
 	"io"
 	"os"
@@ -34,10 +35,10 @@ const (
 	hruleTag         = "\n.ti 0\n\\l'\\n(.lu'\n"
 	linkTag          = "\n\\[la]"
 	linkCloseTag     = "\\[ra]"
-	codespanTag      = "\\fB\\fC"
+	codespanTag      = "\\fB"
 	codespanCloseTag = "\\fR"
-	codeTag          = "\n.PP\n.RS\n\n.nf\n"
-	codeCloseTag     = "\n.fi\n.RE\n"
+	codeTag          = "\n.EX\n"
+	codeCloseTag     = "\n.EE\n"
 	quoteTag         = "\n.PP\n.RS\n"
 	quoteCloseTag    = "\n.RE\n"
 	listTag          = "\n.RS\n"
@@ -86,8 +87,7 @@ func (r *roffRenderer) RenderFooter(w io.Writer, ast *blackfriday.Node) {
 // RenderNode is called for each node in a markdown document; based on the node
 // type the equivalent roff output is sent to the writer
 func (r *roffRenderer) RenderNode(w io.Writer, node *blackfriday.Node, entering bool) blackfriday.WalkStatus {
-
-	var walkAction = blackfriday.GoToNext
+	walkAction := blackfriday.GoToNext
 
 	switch node.Type {
 	case blackfriday.Text:
@@ -109,9 +109,16 @@ func (r *roffRenderer) RenderNode(w io.Writer, node *blackfriday.Node, entering
 			out(w, strongCloseTag)
 		}
 	case blackfriday.Link:
-		if !entering {
-			out(w, linkTag+string(node.LinkData.Destination)+linkCloseTag)
+		// Don't render the link text for automatic links, because this
+		// will only duplicate the URL in the roff output.
+		// See https://daringfireball.net/projects/markdown/syntax#autolink
+		if !bytes.Equal(node.LinkData.Destination, node.FirstChild.Literal) {
+			out(w, string(node.FirstChild.Literal))
 		}
+		// Hyphens in a link must be escaped to avoid word-wrap in the rendered man page.
+		escapedLink := strings.ReplaceAll(string(node.LinkData.Destination), "-", "\\-")
+		out(w, linkTag+escapedLink+linkCloseTag)
+		walkAction = blackfriday.SkipChildren
 	case blackfriday.Image:
 		// ignore images
 		walkAction = blackfriday.SkipChildren
@@ -160,6 +167,11 @@ func (r *roffRenderer) RenderNode(w io.Writer, node *blackfriday.Node, entering
 		r.handleTableCell(w, node, entering)
 	case blackfriday.HTMLSpan:
 		// ignore other HTML tags
+	case blackfriday.HTMLBlock:
+		if bytes.HasPrefix(node.Literal, []byte("<!--")) {
+			break // ignore comments, no warning
+		}
+		fmt.Fprintln(os.Stderr, "WARNING: go-md2man does not handle node type "+node.Type.String())
 	default:
 		fmt.Fprintln(os.Stderr, "WARNING: go-md2man does not handle node type "+node.Type.String())
 	}
@@ -254,7 +266,7 @@ func (r *roffRenderer) handleTableCell(w io.Writer, node *blackfriday.Node, ente
 			start = "\t"
 		}
 		if node.IsHeader {
-			start += codespanTag
+			start += strongTag
 		} else if nodeLiteralSize(node) > 30 {
 			start += tableCellStart
 		}
@@ -262,7 +274,7 @@ func (r *roffRenderer) handleTableCell(w io.Writer, node *blackfriday.Node, ente
 	} else {
 		var end string
 		if node.IsHeader {
-			end = codespanCloseTag
+			end = strongCloseTag
 		} else if nodeLiteralSize(node) > 30 {
 			end = tableCellEnd
 		}
diff --git a/vendor/github.com/google/go-cmp/cmp/cmpopts/equate.go b/vendor/github.com/google/go-cmp/cmp/cmpopts/equate.go
index e54a76c7e..3d8d0cd3a 100644
--- a/vendor/github.com/google/go-cmp/cmp/cmpopts/equate.go
+++ b/vendor/github.com/google/go-cmp/cmp/cmpopts/equate.go
@@ -7,6 +7,7 @@ package cmpopts
 
 import (
 	"errors"
+	"fmt"
 	"math"
 	"reflect"
 	"time"
@@ -16,10 +17,10 @@ import (
 
 func equateAlways(_, _ interface{}) bool { return true }
 
-// EquateEmpty returns a Comparer option that determines all maps and slices
+// EquateEmpty returns a [cmp.Comparer] option that determines all maps and slices
 // with a length of zero to be equal, regardless of whether they are nil.
 //
-// EquateEmpty can be used in conjunction with SortSlices and SortMaps.
+// EquateEmpty can be used in conjunction with [SortSlices] and [SortMaps].
 func EquateEmpty() cmp.Option {
 	return cmp.FilterValues(isEmpty, cmp.Comparer(equateAlways))
 }
@@ -31,7 +32,7 @@ func isEmpty(x, y interface{}) bool {
 		(vx.Len() == 0 && vy.Len() == 0)
 }
 
-// EquateApprox returns a Comparer option that determines float32 or float64
+// EquateApprox returns a [cmp.Comparer] option that determines float32 or float64
 // values to be equal if they are within a relative fraction or absolute margin.
 // This option is not used when either x or y is NaN or infinite.
 //
@@ -45,7 +46,7 @@ func isEmpty(x, y interface{}) bool {
 //
 //	|x-y| ≤ max(fraction*min(|x|, |y|), margin)
 //
-// EquateApprox can be used in conjunction with EquateNaNs.
+// EquateApprox can be used in conjunction with [EquateNaNs].
 func EquateApprox(fraction, margin float64) cmp.Option {
 	if margin < 0 || fraction < 0 || math.IsNaN(margin) || math.IsNaN(fraction) {
 		panic("margin or fraction must be a non-negative number")
@@ -73,10 +74,10 @@ func (a approximator) compareF32(x, y float32) bool {
 	return a.compareF64(float64(x), float64(y))
 }
 
-// EquateNaNs returns a Comparer option that determines float32 and float64
+// EquateNaNs returns a [cmp.Comparer] option that determines float32 and float64
 // NaN values to be equal.
 //
-// EquateNaNs can be used in conjunction with EquateApprox.
+// EquateNaNs can be used in conjunction with [EquateApprox].
 func EquateNaNs() cmp.Option {
 	return cmp.Options{
 		cmp.FilterValues(areNaNsF64s, cmp.Comparer(equateAlways)),
@@ -91,8 +92,8 @@ func areNaNsF32s(x, y float32) bool {
 	return areNaNsF64s(float64(x), float64(y))
 }
 
-// EquateApproxTime returns a Comparer option that determines two non-zero
-// time.Time values to be equal if they are within some margin of one another.
+// EquateApproxTime returns a [cmp.Comparer] option that determines two non-zero
+// [time.Time] values to be equal if they are within some margin of one another.
 // If both times have a monotonic clock reading, then the monotonic time
 // difference will be used. The margin must be non-negative.
 func EquateApproxTime(margin time.Duration) cmp.Option {
@@ -131,8 +132,8 @@ type anyError struct{}
 func (anyError) Error() string     { return "any error" }
 func (anyError) Is(err error) bool { return err != nil }
 
-// EquateErrors returns a Comparer option that determines errors to be equal
-// if errors.Is reports them to match. The AnyError error can be used to
+// EquateErrors returns a [cmp.Comparer] option that determines errors to be equal
+// if [errors.Is] reports them to match. The [AnyError] error can be used to
 // match any non-nil error.
 func EquateErrors() cmp.Option {
 	return cmp.FilterValues(areConcreteErrors, cmp.Comparer(compareErrors))
@@ -154,3 +155,31 @@ func compareErrors(x, y interface{}) bool {
 	ye := y.(error)
 	return errors.Is(xe, ye) || errors.Is(ye, xe)
 }
+
+// EquateComparable returns a [cmp.Option] that determines equality
+// of comparable types by directly comparing them using the == operator in Go.
+// The types to compare are specified by passing a value of that type.
+// This option should only be used on types that are documented as being
+// safe for direct == comparison. For example, [net/netip.Addr] is documented
+// as being semantically safe to use with ==, while [time.Time] is documented
+// to discourage the use of == on time values.
+func EquateComparable(typs ...interface{}) cmp.Option {
+	types := make(typesFilter)
+	for _, typ := range typs {
+		switch t := reflect.TypeOf(typ); {
+		case !t.Comparable():
+			panic(fmt.Sprintf("%T is not a comparable Go type", typ))
+		case types[t]:
+			panic(fmt.Sprintf("%T is already specified", typ))
+		default:
+			types[t] = true
+		}
+	}
+	return cmp.FilterPath(types.filter, cmp.Comparer(equateAny))
+}
+
+type typesFilter map[reflect.Type]bool
+
+func (tf typesFilter) filter(p cmp.Path) bool { return tf[p.Last().Type()] }
+
+func equateAny(x, y interface{}) bool { return x == y }
diff --git a/vendor/github.com/google/go-cmp/cmp/cmpopts/ignore.go b/vendor/github.com/google/go-cmp/cmp/cmpopts/ignore.go
index 80c60617e..fb84d11d7 100644
--- a/vendor/github.com/google/go-cmp/cmp/cmpopts/ignore.go
+++ b/vendor/github.com/google/go-cmp/cmp/cmpopts/ignore.go
@@ -14,7 +14,7 @@ import (
 	"github.com/google/go-cmp/cmp/internal/function"
 )
 
-// IgnoreFields returns an Option that ignores fields of the
+// IgnoreFields returns an [cmp.Option] that ignores fields of the
 // given names on a single struct type. It respects the names of exported fields
 // that are forwarded due to struct embedding.
 // The struct type is specified by passing in a value of that type.
@@ -26,7 +26,7 @@ func IgnoreFields(typ interface{}, names ...string) cmp.Option {
 	return cmp.FilterPath(sf.filter, cmp.Ignore())
 }
 
-// IgnoreTypes returns an Option that ignores all values assignable to
+// IgnoreTypes returns an [cmp.Option] that ignores all values assignable to
 // certain types, which are specified by passing in a value of each type.
 func IgnoreTypes(typs ...interface{}) cmp.Option {
 	tf := newTypeFilter(typs...)
@@ -59,10 +59,10 @@ func (tf typeFilter) filter(p cmp.Path) bool {
 	return false
 }
 
-// IgnoreInterfaces returns an Option that ignores all values or references of
+// IgnoreInterfaces returns an [cmp.Option] that ignores all values or references of
 // values assignable to certain interface types. These interfaces are specified
 // by passing in an anonymous struct with the interface types embedded in it.
-// For example, to ignore sync.Locker, pass in struct{sync.Locker}{}.
+// For example, to ignore [sync.Locker], pass in struct{sync.Locker}{}.
 func IgnoreInterfaces(ifaces interface{}) cmp.Option {
 	tf := newIfaceFilter(ifaces)
 	return cmp.FilterPath(tf.filter, cmp.Ignore())
@@ -107,7 +107,7 @@ func (tf ifaceFilter) filter(p cmp.Path) bool {
 	return false
 }
 
-// IgnoreUnexported returns an Option that only ignores the immediate unexported
+// IgnoreUnexported returns an [cmp.Option] that only ignores the immediate unexported
 // fields of a struct, including anonymous fields of unexported types.
 // In particular, unexported fields within the struct's exported fields
 // of struct types, including anonymous fields, will not be ignored unless the
@@ -115,7 +115,7 @@ func (tf ifaceFilter) filter(p cmp.Path) bool {
 //
 // Avoid ignoring unexported fields of a type which you do not control (i.e. a
 // type from another repository), as changes to the implementation of such types
-// may change how the comparison behaves. Prefer a custom Comparer instead.
+// may change how the comparison behaves. Prefer a custom [cmp.Comparer] instead.
 func IgnoreUnexported(typs ...interface{}) cmp.Option {
 	ux := newUnexportedFilter(typs...)
 	return cmp.FilterPath(ux.filter, cmp.Ignore())
@@ -148,7 +148,7 @@ func isExported(id string) bool {
 	return unicode.IsUpper(r)
 }
 
-// IgnoreSliceElements returns an Option that ignores elements of []V.
+// IgnoreSliceElements returns an [cmp.Option] that ignores elements of []V.
 // The discard function must be of the form "func(T) bool" which is used to
 // ignore slice elements of type V, where V is assignable to T.
 // Elements are ignored if the function reports true.
@@ -176,7 +176,7 @@ func IgnoreSliceElements(discardFunc interface{}) cmp.Option {
 	}, cmp.Ignore())
 }
 
-// IgnoreMapEntries returns an Option that ignores entries of map[K]V.
+// IgnoreMapEntries returns an [cmp.Option] that ignores entries of map[K]V.
 // The discard function must be of the form "func(T, R) bool" which is used to
 // ignore map entries of type K and V, where K and V are assignable to T and R.
 // Entries are ignored if the function reports true.
diff --git a/vendor/github.com/google/go-cmp/cmp/cmpopts/sort.go b/vendor/github.com/google/go-cmp/cmp/cmpopts/sort.go
index 0eb2a758c..c6d09dae4 100644
--- a/vendor/github.com/google/go-cmp/cmp/cmpopts/sort.go
+++ b/vendor/github.com/google/go-cmp/cmp/cmpopts/sort.go
@@ -13,7 +13,7 @@ import (
 	"github.com/google/go-cmp/cmp/internal/function"
 )
 
-// SortSlices returns a Transformer option that sorts all []V.
+// SortSlices returns a [cmp.Transformer] option that sorts all []V.
 // The less function must be of the form "func(T, T) bool" which is used to
 // sort any slice with element type V that is assignable to T.
 //
@@ -25,7 +25,7 @@ import (
 // The less function does not have to be "total". That is, if !less(x, y) and
 // !less(y, x) for two elements x and y, their relative order is maintained.
 //
-// SortSlices can be used in conjunction with EquateEmpty.
+// SortSlices can be used in conjunction with [EquateEmpty].
 func SortSlices(lessFunc interface{}) cmp.Option {
 	vf := reflect.ValueOf(lessFunc)
 	if !function.IsType(vf.Type(), function.Less) || vf.IsNil() {
@@ -82,13 +82,13 @@ func (ss sliceSorter) less(v reflect.Value, i, j int) bool {
 	return ss.fnc.Call([]reflect.Value{vx, vy})[0].Bool()
 }
 
-// SortMaps returns a Transformer option that flattens map[K]V types to be a
+// SortMaps returns a [cmp.Transformer] option that flattens map[K]V types to be a
 // sorted []struct{K, V}. The less function must be of the form
 // "func(T, T) bool" which is used to sort any map with key K that is
 // assignable to T.
 //
-// Flattening the map into a slice has the property that cmp.Equal is able to
-// use Comparers on K or the K.Equal method if it exists.
+// Flattening the map into a slice has the property that [cmp.Equal] is able to
+// use [cmp.Comparer] options on K or the K.Equal method if it exists.
 //
 // The less function must be:
 //   - Deterministic: less(x, y) == less(x, y)
@@ -96,7 +96,7 @@ func (ss sliceSorter) less(v reflect.Value, i, j int) bool {
 //   - Transitive: if !less(x, y) and !less(y, z), then !less(x, z)
 //   - Total: if x != y, then either less(x, y) or less(y, x)
 //
-// SortMaps can be used in conjunction with EquateEmpty.
+// SortMaps can be used in conjunction with [EquateEmpty].
 func SortMaps(lessFunc interface{}) cmp.Option {
 	vf := reflect.ValueOf(lessFunc)
 	if !function.IsType(vf.Type(), function.Less) || vf.IsNil() {
diff --git a/vendor/github.com/google/go-cmp/cmp/cmpopts/xform.go b/vendor/github.com/google/go-cmp/cmp/cmpopts/xform.go
index 8812443a2..25b4bd05b 100644
--- a/vendor/github.com/google/go-cmp/cmp/cmpopts/xform.go
+++ b/vendor/github.com/google/go-cmp/cmp/cmpopts/xform.go
@@ -19,7 +19,7 @@ func (xf xformFilter) filter(p cmp.Path) bool {
 	return true
 }
 
-// AcyclicTransformer returns a Transformer with a filter applied that ensures
+// AcyclicTransformer returns a [cmp.Transformer] with a filter applied that ensures
 // that the transformer cannot be recursively applied upon its own output.
 //
 // An example use case is a transformer that splits a string by lines:
@@ -28,7 +28,7 @@ func (xf xformFilter) filter(p cmp.Path) bool {
 //		return strings.Split(s, "\n")
 //	})
 //
-// Had this been an unfiltered Transformer instead, this would result in an
+// Had this been an unfiltered [cmp.Transformer] instead, this would result in an
 // infinite cycle converting a string to []string to [][]string and so on.
 func AcyclicTransformer(name string, xformFunc interface{}) cmp.Option {
 	xf := xformFilter{cmp.Transformer(name, xformFunc)}
diff --git a/vendor/github.com/google/go-cmp/cmp/compare.go b/vendor/github.com/google/go-cmp/cmp/compare.go
index 087320da7..0f5b8a48c 100644
--- a/vendor/github.com/google/go-cmp/cmp/compare.go
+++ b/vendor/github.com/google/go-cmp/cmp/compare.go
@@ -5,7 +5,7 @@
 // Package cmp determines equality of values.
 //
 // This package is intended to be a more powerful and safer alternative to
-// reflect.DeepEqual for comparing whether two values are semantically equal.
+// [reflect.DeepEqual] for comparing whether two values are semantically equal.
 // It is intended to only be used in tests, as performance is not a goal and
 // it may panic if it cannot compare the values. Its propensity towards
 // panicking means that its unsuitable for production environments where a
@@ -18,16 +18,17 @@
 //     For example, an equality function may report floats as equal so long as
 //     they are within some tolerance of each other.
 //
-//   - Types with an Equal method may use that method to determine equality.
-//     This allows package authors to determine the equality operation
-//     for the types that they define.
+//   - Types with an Equal method (e.g., [time.Time.Equal]) may use that method
+//     to determine equality. This allows package authors to determine
+//     the equality operation for the types that they define.
 //
 //   - If no custom equality functions are used and no Equal method is defined,
 //     equality is determined by recursively comparing the primitive kinds on
-//     both values, much like reflect.DeepEqual. Unlike reflect.DeepEqual,
+//     both values, much like [reflect.DeepEqual]. Unlike [reflect.DeepEqual],
 //     unexported fields are not compared by default; they result in panics
-//     unless suppressed by using an Ignore option (see cmpopts.IgnoreUnexported)
-//     or explicitly compared using the Exporter option.
+//     unless suppressed by using an [Ignore] option
+//     (see [github.com/google/go-cmp/cmp/cmpopts.IgnoreUnexported])
+//     or explicitly compared using the [Exporter] option.
 package cmp
 
 import (
@@ -45,14 +46,14 @@ import (
 // Equal reports whether x and y are equal by recursively applying the
 // following rules in the given order to x and y and all of their sub-values:
 //
-//   - Let S be the set of all Ignore, Transformer, and Comparer options that
+//   - Let S be the set of all [Ignore], [Transformer], and [Comparer] options that
 //     remain after applying all path filters, value filters, and type filters.
-//     If at least one Ignore exists in S, then the comparison is ignored.
-//     If the number of Transformer and Comparer options in S is non-zero,
+//     If at least one [Ignore] exists in S, then the comparison is ignored.
+//     If the number of [Transformer] and [Comparer] options in S is non-zero,
 //     then Equal panics because it is ambiguous which option to use.
-//     If S contains a single Transformer, then use that to transform
+//     If S contains a single [Transformer], then use that to transform
 //     the current values and recursively call Equal on the output values.
-//     If S contains a single Comparer, then use that to compare the current values.
+//     If S contains a single [Comparer], then use that to compare the current values.
 //     Otherwise, evaluation proceeds to the next rule.
 //
 //   - If the values have an Equal method of the form "(T) Equal(T) bool" or
@@ -66,21 +67,22 @@ import (
 //     Functions are only equal if they are both nil, otherwise they are unequal.
 //
 // Structs are equal if recursively calling Equal on all fields report equal.
-// If a struct contains unexported fields, Equal panics unless an Ignore option
-// (e.g., cmpopts.IgnoreUnexported) ignores that field or the Exporter option
-// explicitly permits comparing the unexported field.
+// If a struct contains unexported fields, Equal panics unless an [Ignore] option
+// (e.g., [github.com/google/go-cmp/cmp/cmpopts.IgnoreUnexported]) ignores that field
+// or the [Exporter] option explicitly permits comparing the unexported field.
 //
 // Slices are equal if they are both nil or both non-nil, where recursively
 // calling Equal on all non-ignored slice or array elements report equal.
 // Empty non-nil slices and nil slices are not equal; to equate empty slices,
-// consider using cmpopts.EquateEmpty.
+// consider using [github.com/google/go-cmp/cmp/cmpopts.EquateEmpty].
 //
 // Maps are equal if they are both nil or both non-nil, where recursively
 // calling Equal on all non-ignored map entries report equal.
 // Map keys are equal according to the == operator.
-// To use custom comparisons for map keys, consider using cmpopts.SortMaps.
+// To use custom comparisons for map keys, consider using
+// [github.com/google/go-cmp/cmp/cmpopts.SortMaps].
 // Empty non-nil maps and nil maps are not equal; to equate empty maps,
-// consider using cmpopts.EquateEmpty.
+// consider using [github.com/google/go-cmp/cmp/cmpopts.EquateEmpty].
 //
 // Pointers and interfaces are equal if they are both nil or both non-nil,
 // where they have the same underlying concrete type and recursively
diff --git a/vendor/github.com/google/go-cmp/cmp/export_unsafe.go b/vendor/github.com/google/go-cmp/cmp/export.go
similarity index 94%
rename from vendor/github.com/google/go-cmp/cmp/export_unsafe.go
rename to vendor/github.com/google/go-cmp/cmp/export.go
index e2c0f74e8..29f82fe6b 100644
--- a/vendor/github.com/google/go-cmp/cmp/export_unsafe.go
+++ b/vendor/github.com/google/go-cmp/cmp/export.go
@@ -2,9 +2,6 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build !purego
-// +build !purego
-
 package cmp
 
 import (
@@ -12,8 +9,6 @@ import (
 	"unsafe"
 )
 
-const supportExporters = true
-
 // retrieveUnexportedField uses unsafe to forcibly retrieve any field from
 // a struct such that the value has read-write permissions.
 //
diff --git a/vendor/github.com/google/go-cmp/cmp/export_panic.go b/vendor/github.com/google/go-cmp/cmp/export_panic.go
deleted file mode 100644
index ae851fe53..000000000
--- a/vendor/github.com/google/go-cmp/cmp/export_panic.go
+++ /dev/null
@@ -1,16 +0,0 @@
-// Copyright 2017, The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build purego
-// +build purego
-
-package cmp
-
-import "reflect"
-
-const supportExporters = false
-
-func retrieveUnexportedField(reflect.Value, reflect.StructField, bool) reflect.Value {
-	panic("no support for forcibly accessing unexported fields")
-}
diff --git a/vendor/github.com/google/go-cmp/cmp/internal/value/pointer_unsafe.go b/vendor/github.com/google/go-cmp/cmp/internal/value/pointer.go
similarity index 95%
rename from vendor/github.com/google/go-cmp/cmp/internal/value/pointer_unsafe.go
rename to vendor/github.com/google/go-cmp/cmp/internal/value/pointer.go
index 16e6860af..e5dfff69a 100644
--- a/vendor/github.com/google/go-cmp/cmp/internal/value/pointer_unsafe.go
+++ b/vendor/github.com/google/go-cmp/cmp/internal/value/pointer.go
@@ -2,9 +2,6 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build !purego
-// +build !purego
-
 package value
 
 import (
diff --git a/vendor/github.com/google/go-cmp/cmp/internal/value/pointer_purego.go b/vendor/github.com/google/go-cmp/cmp/internal/value/pointer_purego.go
deleted file mode 100644
index 1a71bfcbd..000000000
--- a/vendor/github.com/google/go-cmp/cmp/internal/value/pointer_purego.go
+++ /dev/null
@@ -1,34 +0,0 @@
-// Copyright 2018, The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-//go:build purego
-// +build purego
-
-package value
-
-import "reflect"
-
-// Pointer is an opaque typed pointer and is guaranteed to be comparable.
-type Pointer struct {
-	p uintptr
-	t reflect.Type
-}
-
-// PointerOf returns a Pointer from v, which must be a
-// reflect.Ptr, reflect.Slice, or reflect.Map.
-func PointerOf(v reflect.Value) Pointer {
-	// NOTE: Storing a pointer as an uintptr is technically incorrect as it
-	// assumes that the GC implementation does not use a moving collector.
-	return Pointer{v.Pointer(), v.Type()}
-}
-
-// IsNil reports whether the pointer is nil.
-func (p Pointer) IsNil() bool {
-	return p.p == 0
-}
-
-// Uintptr returns the pointer as a uintptr.
-func (p Pointer) Uintptr() uintptr {
-	return p.p
-}
diff --git a/vendor/github.com/google/go-cmp/cmp/options.go b/vendor/github.com/google/go-cmp/cmp/options.go
index 1f9ca9c48..754496f3b 100644
--- a/vendor/github.com/google/go-cmp/cmp/options.go
+++ b/vendor/github.com/google/go-cmp/cmp/options.go
@@ -13,15 +13,15 @@ import (
 	"github.com/google/go-cmp/cmp/internal/function"
 )
 
-// Option configures for specific behavior of Equal and Diff. In particular,
-// the fundamental Option functions (Ignore, Transformer, and Comparer),
+// Option configures for specific behavior of [Equal] and [Diff]. In particular,
+// the fundamental Option functions ([Ignore], [Transformer], and [Comparer]),
 // configure how equality is determined.
 //
-// The fundamental options may be composed with filters (FilterPath and
-// FilterValues) to control the scope over which they are applied.
+// The fundamental options may be composed with filters ([FilterPath] and
+// [FilterValues]) to control the scope over which they are applied.
 //
-// The cmp/cmpopts package provides helper functions for creating options that
-// may be used with Equal and Diff.
+// The [github.com/google/go-cmp/cmp/cmpopts] package provides helper functions
+// for creating options that may be used with [Equal] and [Diff].
 type Option interface {
 	// filter applies all filters and returns the option that remains.
 	// Each option may only read s.curPath and call s.callTTBFunc.
@@ -56,9 +56,9 @@ type core struct{}
 
 func (core) isCore() {}
 
-// Options is a list of Option values that also satisfies the Option interface.
+// Options is a list of [Option] values that also satisfies the [Option] interface.
 // Helper comparison packages may return an Options value when packing multiple
-// Option values into a single Option. When this package processes an Options,
+// [Option] values into a single [Option]. When this package processes an Options,
 // it will be implicitly expanded into a flat list.
 //
 // Applying a filter on an Options is equivalent to applying that same filter
@@ -105,16 +105,16 @@ func (opts Options) String() string {
 	return fmt.Sprintf("Options{%s}", strings.Join(ss, ", "))
 }
 
-// FilterPath returns a new Option where opt is only evaluated if filter f
-// returns true for the current Path in the value tree.
+// FilterPath returns a new [Option] where opt is only evaluated if filter f
+// returns true for the current [Path] in the value tree.
 //
 // This filter is called even if a slice element or map entry is missing and
 // provides an opportunity to ignore such cases. The filter function must be
 // symmetric such that the filter result is identical regardless of whether the
 // missing value is from x or y.
 //
-// The option passed in may be an Ignore, Transformer, Comparer, Options, or
-// a previously filtered Option.
+// The option passed in may be an [Ignore], [Transformer], [Comparer], [Options], or
+// a previously filtered [Option].
 func FilterPath(f func(Path) bool, opt Option) Option {
 	if f == nil {
 		panic("invalid path filter function")
@@ -142,7 +142,7 @@ func (f pathFilter) String() string {
 	return fmt.Sprintf("FilterPath(%s, %v)", function.NameOf(reflect.ValueOf(f.fnc)), f.opt)
 }
 
-// FilterValues returns a new Option where opt is only evaluated if filter f,
+// FilterValues returns a new [Option] where opt is only evaluated if filter f,
 // which is a function of the form "func(T, T) bool", returns true for the
 // current pair of values being compared. If either value is invalid or
 // the type of the values is not assignable to T, then this filter implicitly
@@ -154,8 +154,8 @@ func (f pathFilter) String() string {
 // If T is an interface, it is possible that f is called with two values with
 // different concrete types that both implement T.
 //
-// The option passed in may be an Ignore, Transformer, Comparer, Options, or
-// a previously filtered Option.
+// The option passed in may be an [Ignore], [Transformer], [Comparer], [Options], or
+// a previously filtered [Option].
 func FilterValues(f interface{}, opt Option) Option {
 	v := reflect.ValueOf(f)
 	if !function.IsType(v.Type(), function.ValueFilter) || v.IsNil() {
@@ -192,9 +192,9 @@ func (f valuesFilter) String() string {
 	return fmt.Sprintf("FilterValues(%s, %v)", function.NameOf(f.fnc), f.opt)
 }
 
-// Ignore is an Option that causes all comparisons to be ignored.
-// This value is intended to be combined with FilterPath or FilterValues.
-// It is an error to pass an unfiltered Ignore option to Equal.
+// Ignore is an [Option] that causes all comparisons to be ignored.
+// This value is intended to be combined with [FilterPath] or [FilterValues].
+// It is an error to pass an unfiltered Ignore option to [Equal].
 func Ignore() Option { return ignore{} }
 
 type ignore struct{ core }
@@ -234,6 +234,8 @@ func (validator) apply(s *state, vx, vy reflect.Value) {
 			name = fmt.Sprintf("%q.%v", t.PkgPath(), t.Name()) // e.g., "path/to/package".MyType
 			if _, ok := reflect.New(t).Interface().(error); ok {
 				help = "consider using cmpopts.EquateErrors to compare error values"
+			} else if t.Comparable() {
+				help = "consider using cmpopts.EquateComparable to compare comparable Go types"
 			}
 		} else {
 			// Unnamed type with unexported fields. Derive PkgPath from field.
@@ -254,7 +256,7 @@ const identRx = `[_\p{L}][_\p{L}\p{N}]*`
 
 var identsRx = regexp.MustCompile(`^` + identRx + `(\.` + identRx + `)*$`)
 
-// Transformer returns an Option that applies a transformation function that
+// Transformer returns an [Option] that applies a transformation function that
 // converts values of a certain type into that of another.
 //
 // The transformer f must be a function "func(T) R" that converts values of
@@ -265,13 +267,14 @@ var identsRx = regexp.MustCompile(`^` + identRx + `(\.` + identRx + `)*$`)
 // same transform to the output of itself (e.g., in the case where the
 // input and output types are the same), an implicit filter is added such that
 // a transformer is applicable only if that exact transformer is not already
-// in the tail of the Path since the last non-Transform step.
+// in the tail of the [Path] since the last non-[Transform] step.
 // For situations where the implicit filter is still insufficient,
-// consider using cmpopts.AcyclicTransformer, which adds a filter
-// to prevent the transformer from being recursively applied upon itself.
+// consider using [github.com/google/go-cmp/cmp/cmpopts.AcyclicTransformer],
+// which adds a filter to prevent the transformer from
+// being recursively applied upon itself.
 //
-// The name is a user provided label that is used as the Transform.Name in the
-// transformation PathStep (and eventually shown in the Diff output).
+// The name is a user provided label that is used as the [Transform.Name] in the
+// transformation [PathStep] (and eventually shown in the [Diff] output).
 // The name must be a valid identifier or qualified identifier in Go syntax.
 // If empty, an arbitrary name is used.
 func Transformer(name string, f interface{}) Option {
@@ -329,7 +332,7 @@ func (tr transformer) String() string {
 	return fmt.Sprintf("Transformer(%s, %s)", tr.name, function.NameOf(tr.fnc))
 }
 
-// Comparer returns an Option that determines whether two values are equal
+// Comparer returns an [Option] that determines whether two values are equal
 // to each other.
 //
 // The comparer f must be a function "func(T, T) bool" and is implicitly
@@ -377,35 +380,32 @@ func (cm comparer) String() string {
 	return fmt.Sprintf("Comparer(%s)", function.NameOf(cm.fnc))
 }
 
-// Exporter returns an Option that specifies whether Equal is allowed to
+// Exporter returns an [Option] that specifies whether [Equal] is allowed to
 // introspect into the unexported fields of certain struct types.
 //
 // Users of this option must understand that comparing on unexported fields
 // from external packages is not safe since changes in the internal
-// implementation of some external package may cause the result of Equal
+// implementation of some external package may cause the result of [Equal]
 // to unexpectedly change. However, it may be valid to use this option on types
 // defined in an internal package where the semantic meaning of an unexported
 // field is in the control of the user.
 //
-// In many cases, a custom Comparer should be used instead that defines
+// In many cases, a custom [Comparer] should be used instead that defines
 // equality as a function of the public API of a type rather than the underlying
 // unexported implementation.
 //
-// For example, the reflect.Type documentation defines equality to be determined
+// For example, the [reflect.Type] documentation defines equality to be determined
 // by the == operator on the interface (essentially performing a shallow pointer
-// comparison) and most attempts to compare *regexp.Regexp types are interested
+// comparison) and most attempts to compare *[regexp.Regexp] types are interested
 // in only checking that the regular expression strings are equal.
-// Both of these are accomplished using Comparers:
+// Both of these are accomplished using [Comparer] options:
 //
 //	Comparer(func(x, y reflect.Type) bool { return x == y })
 //	Comparer(func(x, y *regexp.Regexp) bool { return x.String() == y.String() })
 //
-// In other cases, the cmpopts.IgnoreUnexported option can be used to ignore
-// all unexported fields on specified struct types.
+// In other cases, the [github.com/google/go-cmp/cmp/cmpopts.IgnoreUnexported]
+// option can be used to ignore all unexported fields on specified struct types.
 func Exporter(f func(reflect.Type) bool) Option {
-	if !supportExporters {
-		panic("Exporter is not supported on purego builds")
-	}
 	return exporter(f)
 }
 
@@ -415,10 +415,10 @@ func (exporter) filter(_ *state, _ reflect.Type, _, _ reflect.Value) applicableO
 	panic("not implemented")
 }
 
-// AllowUnexported returns an Options that allows Equal to forcibly introspect
+// AllowUnexported returns an [Option] that allows [Equal] to forcibly introspect
 // unexported fields of the specified struct types.
 //
-// See Exporter for the proper use of this option.
+// See [Exporter] for the proper use of this option.
 func AllowUnexported(types ...interface{}) Option {
 	m := make(map[reflect.Type]bool)
 	for _, typ := range types {
@@ -432,7 +432,7 @@ func AllowUnexported(types ...interface{}) Option {
 }
 
 // Result represents the comparison result for a single node and
-// is provided by cmp when calling Report (see Reporter).
+// is provided by cmp when calling Report (see [Reporter]).
 type Result struct {
 	_     [0]func() // Make Result incomparable
 	flags resultFlags
@@ -445,7 +445,7 @@ func (r Result) Equal() bool {
 }
 
 // ByIgnore reports whether the node is equal because it was ignored.
-// This never reports true if Equal reports false.
+// This never reports true if [Result.Equal] reports false.
 func (r Result) ByIgnore() bool {
 	return r.flags&reportByIgnore != 0
 }
@@ -455,7 +455,7 @@ func (r Result) ByMethod() bool {
 	return r.flags&reportByMethod != 0
 }
 
-// ByFunc reports whether a Comparer function determined equality.
+// ByFunc reports whether a [Comparer] function determined equality.
 func (r Result) ByFunc() bool {
 	return r.flags&reportByFunc != 0
 }
@@ -478,7 +478,7 @@ const (
 	reportByCycle
 )
 
-// Reporter is an Option that can be passed to Equal. When Equal traverses
+// Reporter is an [Option] that can be passed to [Equal]. When [Equal] traverses
 // the value trees, it calls PushStep as it descends into each node in the
 // tree and PopStep as it ascend out of the node. The leaves of the tree are
 // either compared (determined to be equal or not equal) or ignored and reported
diff --git a/vendor/github.com/google/go-cmp/cmp/path.go b/vendor/github.com/google/go-cmp/cmp/path.go
index a0a588502..c3c145642 100644
--- a/vendor/github.com/google/go-cmp/cmp/path.go
+++ b/vendor/github.com/google/go-cmp/cmp/path.go
@@ -14,9 +14,9 @@ import (
 	"github.com/google/go-cmp/cmp/internal/value"
 )
 
-// Path is a list of PathSteps describing the sequence of operations to get
+// Path is a list of [PathStep] describing the sequence of operations to get
 // from some root type to the current position in the value tree.
-// The first Path element is always an operation-less PathStep that exists
+// The first Path element is always an operation-less [PathStep] that exists
 // simply to identify the initial type.
 //
 // When traversing structs with embedded structs, the embedded struct will
@@ -29,8 +29,13 @@ type Path []PathStep
 // a value's tree structure. Users of this package never need to implement
 // these types as values of this type will be returned by this package.
 //
-// Implementations of this interface are
-// StructField, SliceIndex, MapIndex, Indirect, TypeAssertion, and Transform.
+// Implementations of this interface:
+//   - [StructField]
+//   - [SliceIndex]
+//   - [MapIndex]
+//   - [Indirect]
+//   - [TypeAssertion]
+//   - [Transform]
 type PathStep interface {
 	String() string
 
@@ -70,8 +75,9 @@ func (pa *Path) pop() {
 	*pa = (*pa)[:len(*pa)-1]
 }
 
-// Last returns the last PathStep in the Path.
-// If the path is empty, this returns a non-nil PathStep that reports a nil Type.
+// Last returns the last [PathStep] in the Path.
+// If the path is empty, this returns a non-nil [PathStep]
+// that reports a nil [PathStep.Type].
 func (pa Path) Last() PathStep {
 	return pa.Index(-1)
 }
@@ -79,7 +85,8 @@ func (pa Path) Last() PathStep {
 // Index returns the ith step in the Path and supports negative indexing.
 // A negative index starts counting from the tail of the Path such that -1
 // refers to the last step, -2 refers to the second-to-last step, and so on.
-// If index is invalid, this returns a non-nil PathStep that reports a nil Type.
+// If index is invalid, this returns a non-nil [PathStep]
+// that reports a nil [PathStep.Type].
 func (pa Path) Index(i int) PathStep {
 	if i < 0 {
 		i = len(pa) + i
@@ -168,7 +175,8 @@ func (ps pathStep) String() string {
 	return fmt.Sprintf("{%s}", s)
 }
 
-// StructField represents a struct field access on a field called Name.
+// StructField is a [PathStep] that represents a struct field access
+// on a field called [StructField.Name].
 type StructField struct{ *structField }
 type structField struct {
 	pathStep
@@ -204,10 +212,11 @@ func (sf StructField) String() string { return fmt.Sprintf(".%s", sf.name) }
 func (sf StructField) Name() string { return sf.name }
 
 // Index is the index of the field in the parent struct type.
-// See reflect.Type.Field.
+// See [reflect.Type.Field].
 func (sf StructField) Index() int { return sf.idx }
 
-// SliceIndex is an index operation on a slice or array at some index Key.
+// SliceIndex is a [PathStep] that represents an index operation on
+// a slice or array at some index [SliceIndex.Key].
 type SliceIndex struct{ *sliceIndex }
 type sliceIndex struct {
 	pathStep
@@ -247,12 +256,12 @@ func (si SliceIndex) Key() int {
 // all of the indexes to be shifted. If an index is -1, then that
 // indicates that the element does not exist in the associated slice.
 //
-// Key is guaranteed to return -1 if and only if the indexes returned
-// by SplitKeys are not the same. SplitKeys will never return -1 for
+// [SliceIndex.Key] is guaranteed to return -1 if and only if the indexes
+// returned by SplitKeys are not the same. SplitKeys will never return -1 for
 // both indexes.
 func (si SliceIndex) SplitKeys() (ix, iy int) { return si.xkey, si.ykey }
 
-// MapIndex is an index operation on a map at some index Key.
+// MapIndex is a [PathStep] that represents an index operation on a map at some index Key.
 type MapIndex struct{ *mapIndex }
 type mapIndex struct {
 	pathStep
@@ -266,7 +275,7 @@ func (mi MapIndex) String() string                 { return fmt.Sprintf("[%#v]",
 // Key is the value of the map key.
 func (mi MapIndex) Key() reflect.Value { return mi.key }
 
-// Indirect represents pointer indirection on the parent type.
+// Indirect is a [PathStep] that represents pointer indirection on the parent type.
 type Indirect struct{ *indirect }
 type indirect struct {
 	pathStep
@@ -276,7 +285,7 @@ func (in Indirect) Type() reflect.Type             { return in.typ }
 func (in Indirect) Values() (vx, vy reflect.Value) { return in.vx, in.vy }
 func (in Indirect) String() string                 { return "*" }
 
-// TypeAssertion represents a type assertion on an interface.
+// TypeAssertion is a [PathStep] that represents a type assertion on an interface.
 type TypeAssertion struct{ *typeAssertion }
 type typeAssertion struct {
 	pathStep
@@ -286,7 +295,8 @@ func (ta TypeAssertion) Type() reflect.Type             { return ta.typ }
 func (ta TypeAssertion) Values() (vx, vy reflect.Value) { return ta.vx, ta.vy }
 func (ta TypeAssertion) String() string                 { return fmt.Sprintf(".(%v)", value.TypeString(ta.typ, false)) }
 
-// Transform is a transformation from the parent type to the current type.
+// Transform is a [PathStep] that represents a transformation
+// from the parent type to the current type.
 type Transform struct{ *transform }
 type transform struct {
 	pathStep
@@ -297,13 +307,13 @@ func (tf Transform) Type() reflect.Type             { return tf.typ }
 func (tf Transform) Values() (vx, vy reflect.Value) { return tf.vx, tf.vy }
 func (tf Transform) String() string                 { return fmt.Sprintf("%s()", tf.trans.name) }
 
-// Name is the name of the Transformer.
+// Name is the name of the [Transformer].
 func (tf Transform) Name() string { return tf.trans.name }
 
 // Func is the function pointer to the transformer function.
 func (tf Transform) Func() reflect.Value { return tf.trans.fnc }
 
-// Option returns the originally constructed Transformer option.
+// Option returns the originally constructed [Transformer] option.
 // The == operator can be used to detect the exact option used.
 func (tf Transform) Option() Option { return tf.trans }
 
diff --git a/vendor/github.com/google/go-cmp/cmp/report_reflect.go b/vendor/github.com/google/go-cmp/cmp/report_reflect.go
index 2ab41fad3..e39f42284 100644
--- a/vendor/github.com/google/go-cmp/cmp/report_reflect.go
+++ b/vendor/github.com/google/go-cmp/cmp/report_reflect.go
@@ -199,7 +199,7 @@ func (opts formatOptions) FormatValue(v reflect.Value, parentKind reflect.Kind,
 				break
 			}
 			sf := t.Field(i)
-			if supportExporters && !isExported(sf.Name) {
+			if !isExported(sf.Name) {
 				vv = retrieveUnexportedField(v, sf, true)
 			}
 			s := opts.WithTypeMode(autoType).FormatValue(vv, t.Kind(), ptrs)
diff --git a/vendor/github.com/hashicorp/go-getter/get_git.go b/vendor/github.com/hashicorp/go-getter/get_git.go
index 2313a3fba..908493b9d 100644
--- a/vendor/github.com/hashicorp/go-getter/get_git.go
+++ b/vendor/github.com/hashicorp/go-getter/get_git.go
@@ -302,6 +302,11 @@ func findRemoteDefaultBranch(ctx context.Context, u *url.URL) string {
 // setupGitEnv sets up the environment for the given command. This is used to
 // pass configuration data to git and ssh and enables advanced cloning methods.
 func setupGitEnv(cmd *exec.Cmd, sshKeyFile string) {
+	// If there's no sshKeyFile argument to deal with, we can skip this
+	// entirely.
+	if sshKeyFile == "" {
+		return
+	}
 	const gitSSHCommand = "GIT_SSH_COMMAND="
 	var sshCmd []string
 
@@ -323,14 +328,12 @@ func setupGitEnv(cmd *exec.Cmd, sshKeyFile string) {
 		sshCmd = []string{gitSSHCommand + "ssh"}
 	}
 
-	if sshKeyFile != "" {
-		// We have an SSH key temp file configured, tell ssh about this.
-		if runtime.GOOS == "windows" {
-			sshKeyFile = strings.Replace(sshKeyFile, `\`, `/`, -1)
-		}
-		sshCmd = append(sshCmd, "-i", sshKeyFile)
-		env = append(env, strings.Join(sshCmd, " "))
+	// We have an SSH key temp file configured, tell ssh about this.
+	if runtime.GOOS == "windows" {
+		sshKeyFile = strings.Replace(sshKeyFile, `\`, `/`, -1)
 	}
+	sshCmd = append(sshCmd, "-i", sshKeyFile)
+	env = append(env, strings.Join(sshCmd, " "))
 
 	cmd.Env = env
 }
diff --git a/vendor/github.com/nhost/be/services/mimir/model/cuegraph_gen.go b/vendor/github.com/nhost/be/services/mimir/model/cuegraph_gen.go
index 9c1fc56df..2740c4ad0 100644
--- a/vendor/github.com/nhost/be/services/mimir/model/cuegraph_gen.go
+++ b/vendor/github.com/nhost/be/services/mimir/model/cuegraph_gen.go
@@ -10496,6 +10496,162 @@ func (exp *ConfigHasuraSettingsComparisonExp) Matches(o *ConfigHasuraSettings) b
 	return true
 }
 
+type ConfigIngress struct {
+	Fqdn []string `json:"fqdn,omitempty" toml:"fqdn,omitempty"`
+}
+
+func (o *ConfigIngress) MarshalJSON() ([]byte, error) {
+	m := make(map[string]any)
+	if o.Fqdn != nil {
+		m["fqdn"] = o.Fqdn
+	}
+	return json.Marshal(m)
+}
+
+func (o *ConfigIngress) GetFqdn() []string {
+	if o == nil {
+		o = &ConfigIngress{}
+	}
+	return o.Fqdn
+}
+
+type ConfigIngressUpdateInput struct {
+	Fqdn      []string `json:"fqdn,omitempty" toml:"fqdn,omitempty"`
+	IsSetFqdn bool     `json:"-"`
+}
+
+func (o *ConfigIngressUpdateInput) UnmarshalGQL(v interface{}) error {
+	m, ok := v.(map[string]any)
+	if !ok {
+		return fmt.Errorf("must be map[string]interface{}, got %T", v)
+	}
+	if v, ok := m["fqdn"]; ok {
+		if v != nil {
+			// clearly a not very efficient shortcut
+			b, err := json.Marshal(v)
+			if err != nil {
+				return err
+			}
+			var l []string
+			if err := json.Unmarshal(b, &l); err != nil {
+				return err
+			}
+			o.Fqdn = l
+		}
+		o.IsSetFqdn = true
+	}
+
+	return nil
+}
+
+func (o *ConfigIngressUpdateInput) MarshalGQL(w io.Writer) {
+	enc := json.NewEncoder(w)
+	if err := enc.Encode(o); err != nil {
+		panic(err)
+	}
+}
+
+func (o *ConfigIngressUpdateInput) GetFqdn() []string {
+	if o == nil {
+		o = &ConfigIngressUpdateInput{}
+	}
+	return o.Fqdn
+}
+
+func (s *ConfigIngress) Update(v *ConfigIngressUpdateInput) {
+	if v == nil {
+		return
+	}
+	if v.IsSetFqdn || v.Fqdn != nil {
+		if v.Fqdn == nil {
+			s.Fqdn = nil
+		} else {
+			s.Fqdn = make([]string, len(v.Fqdn))
+			for i, e := range v.Fqdn {
+				s.Fqdn[i] = e
+			}
+		}
+	}
+}
+
+type ConfigIngressInsertInput struct {
+	Fqdn []string `json:"fqdn,omitempty" toml:"fqdn,omitempty"`
+}
+
+func (o *ConfigIngressInsertInput) GetFqdn() []string {
+	if o == nil {
+		o = &ConfigIngressInsertInput{}
+	}
+	return o.Fqdn
+}
+
+func (s *ConfigIngress) Insert(v *ConfigIngressInsertInput) {
+	if v.Fqdn != nil {
+		s.Fqdn = make([]string, len(v.Fqdn))
+		for i, e := range v.Fqdn {
+			s.Fqdn[i] = e
+		}
+	}
+}
+
+func (s *ConfigIngress) Clone() *ConfigIngress {
+	if s == nil {
+		return nil
+	}
+
+	v := &ConfigIngress{}
+	if s.Fqdn != nil {
+		v.Fqdn = make([]string, len(s.Fqdn))
+		copy(v.Fqdn, s.Fqdn)
+	}
+	return v
+}
+
+type ConfigIngressComparisonExp struct {
+	And  []*ConfigIngressComparisonExp `json:"_and,omitempty"`
+	Not  *ConfigIngressComparisonExp   `json:"_not,omitempty"`
+	Or   []*ConfigIngressComparisonExp `json:"_or,omitempty"`
+	Fqdn *ConfigStringComparisonExp    `json:"fqdn,omitempty"`
+}
+
+func (exp *ConfigIngressComparisonExp) Matches(o *ConfigIngress) bool {
+	if exp == nil {
+		return true
+	}
+
+	if o == nil {
+		o = &ConfigIngress{
+			Fqdn: []string{},
+		}
+	}
+	{
+		found := false
+		for _, o := range o.Fqdn {
+			if exp.Fqdn.Matches(o) {
+				found = true
+				break
+			}
+		}
+		if !found && exp.Fqdn != nil {
+			return false
+		}
+	}
+
+	if exp.And != nil && !all(exp.And, o) {
+		return false
+	}
+
+	if exp.Or != nil && !or(exp.Or, o) {
+		return false
+	}
+
+	if exp.Not != nil && exp.Not.Matches(o) {
+		return false
+	}
+
+	return true
+}
+
 // See https://hasura.io/docs/latest/auth/authentication/jwt/
 type ConfigJWTSecret struct {
 	Type *string `json:"type" toml:"type"`
@@ -11244,6 +11400,172 @@ func (exp *ConfigLocaleComparisonExp) Matches(o string) bool {
 	return true
 }
 
+type ConfigNetworking struct {
+	Ingresses []*ConfigIngress `json:"ingresses,omitempty" toml:"ingresses,omitempty"`
+}
+
+func (o *ConfigNetworking) MarshalJSON() ([]byte, error) {
+	m := make(map[string]any)
+	if o.Ingresses != nil {
+		m["ingresses"] = o.Ingresses
+	}
+	return json.Marshal(m)
+}
+
+func (o *ConfigNetworking) GetIngresses() []*ConfigIngress {
+	if o == nil {
+		o = &ConfigNetworking{}
+	}
+	return o.Ingresses
+}
+
+type ConfigNetworkingUpdateInput struct {
+	Ingresses      []*ConfigIngressUpdateInput `json:"ingresses,omitempty" toml:"ingresses,omitempty"`
+	IsSetIngresses bool                        `json:"-"`
+}
+
+func (o *ConfigNetworkingUpdateInput) UnmarshalGQL(v interface{}) error {
+	m, ok := v.(map[string]any)
+	if !ok {
+		return fmt.Errorf("must be map[string]interface{}, got %T", v)
+	}
+	if v, ok := m["ingresses"]; ok {
+		if v != nil {
+			x, ok := v.([]interface{})
+			if !ok {
+				return fmt.Errorf("Ingresses must be []interface{}, got %T", v)
+			}
+
+			l := make([]*ConfigIngressUpdateInput, len(x))
+			for i, vv := range x {
+				t := &ConfigIngressUpdateInput{}
+				if err := t.UnmarshalGQL(vv); err != nil {
+					return err
+				}
+				l[i] = t
+			}
+			o.Ingresses = l
+		}
+		o.IsSetIngresses = true
+	}
+
+	return nil
+}
+
+func (o *ConfigNetworkingUpdateInput) MarshalGQL(w io.Writer) {
+	enc := json.NewEncoder(w)
+	if err := enc.Encode(o); err != nil {
+		panic(err)
+	}
+}
+
+func (o *ConfigNetworkingUpdateInput) GetIngresses() []*ConfigIngressUpdateInput {
+	if o == nil {
+		o = &ConfigNetworkingUpdateInput{}
+	}
+	return o.Ingresses
+}
+
+func (s *ConfigNetworking) Update(v *ConfigNetworkingUpdateInput) {
+	if v == nil {
+		return
+	}
+	if v.IsSetIngresses || v.Ingresses != nil {
+		if v.Ingresses == nil {
+			s.Ingresses = nil
+		} else {
+			s.Ingresses = make([]*ConfigIngress, len(v.Ingresses))
+			for i, e := range v.Ingresses {
+				v := &ConfigIngress{}
+				v.Update(e)
+				s.Ingresses[i] = v
+			}
+		}
+	}
+}
+
+type ConfigNetworkingInsertInput struct {
+	Ingresses []*ConfigIngressInsertInput `json:"ingresses,omitempty" toml:"ingresses,omitempty"`
+}
+
+func (o *ConfigNetworkingInsertInput) GetIngresses() []*ConfigIngressInsertInput {
+	if o == nil {
+		o = &ConfigNetworkingInsertInput{}
+	}
+	return o.Ingresses
+}
+
+func (s *ConfigNetworking) Insert(v *ConfigNetworkingInsertInput) {
+	if v.Ingresses != nil {
+		s.Ingresses = make([]*ConfigIngress, len(v.Ingresses))
+		for i, e := range v.Ingresses {
+			v := &ConfigIngress{}
+			v.Insert(e)
+			s.Ingresses[i] = v
+		}
+	}
+}
+
+func (s *ConfigNetworking) Clone() *ConfigNetworking {
+	if s == nil {
+		return nil
+	}
+
+	v := &ConfigNetworking{}
+	if s.Ingresses != nil {
+		v.Ingresses = make([]*ConfigIngress, len(s.Ingresses))
+		for i, e := range s.Ingresses {
+			v.Ingresses[i] = e.Clone()
+		}
+	}
+	return v
+}
+
+type ConfigNetworkingComparisonExp struct {
+	And       []*ConfigNetworkingComparisonExp `json:"_and,omitempty"`
+	Not       *ConfigNetworkingComparisonExp   `json:"_not,omitempty"`
+	Or        []*ConfigNetworkingComparisonExp `json:"_or,omitempty"`
+	Ingresses *ConfigIngressComparisonExp      `json:"ingresses,omitempty"`
+}
+
+func (exp *ConfigNetworkingComparisonExp) Matches(o *ConfigNetworking) bool {
+	if exp == nil {
+		return true
+	}
+
+	if o == nil {
+		o = &ConfigNetworking{
+			Ingresses: []*ConfigIngress{},
+		}
+	}
+	{
+		found := false
+		for _, o := range o.Ingresses {
+			if exp.Ingresses.Matches(o) {
+				found = true
+				break
+			}
+		}
+		if !found && exp.Ingresses != nil {
+			return false
+		}
+	}
+
+	if exp.And != nil && !all(exp.And, o) {
+		return false
+	}
+
+	if exp.Or != nil && !or(exp.Or, o) {
+		return false
+	}
+
+	if exp.Not != nil && exp.Not.Matches(o) {
+		return false
+	}
+
+	return true
+}
+
 type ConfigObservability struct {
 	Grafana *ConfigGrafana `json:"grafana,omitempty" toml:"grafana,omitempty"`
 }
@@ -11420,7 +11742,7 @@ type ConfigPostgres struct {
 	// https://hub.docker.com/r/nhost/postgres/tags
 	Version *string `json:"version" toml:"version"`
 	// Resources for the service
-	Resources *ConfigResources `json:"resources,omitempty" toml:"resources,omitempty"`
+	Resources *ConfigPostgresResources `json:"resources,omitempty" toml:"resources,omitempty"`
 
 	Settings *ConfigPostgresSettings `json:"settings,omitempty" toml:"settings,omitempty"`
 }
@@ -11446,7 +11768,7 @@ func (o *ConfigPostgres) GetVersion() *string {
 	return o.Version
 }
 
-func (o *ConfigPostgres) GetResources() *ConfigResources {
+func (o *ConfigPostgres) GetResources() *ConfigPostgresResources {
 	if o == nil {
 		return nil
 	}
@@ -11461,12 +11783,12 @@ func (o *ConfigPostgres) GetSettings() *ConfigPostgresSettings {
 }
 
 type ConfigPostgresUpdateInput struct {
-	Version        *string                            `json:"version,omitempty" toml:"version,omitempty"`
-	IsSetVersion   bool                               `json:"-"`
-	Resources      *ConfigResourcesUpdateInput        `json:"resources,omitempty" toml:"resources,omitempty"`
-	IsSetResources bool                               `json:"-"`
-	Settings       *ConfigPostgresSettingsUpdateInput `json:"settings,omitempty" toml:"settings,omitempty"`
-	IsSetSettings  bool                               `json:"-"`
+	Version        *string                             `json:"version,omitempty" toml:"version,omitempty"`
+	IsSetVersion   bool                                `json:"-"`
+	Resources      *ConfigPostgresResourcesUpdateInput `json:"resources,omitempty" toml:"resources,omitempty"`
+	IsSetResources bool                                `json:"-"`
+	Settings       *ConfigPostgresSettingsUpdateInput  `json:"settings,omitempty" toml:"settings,omitempty"`
+	IsSetSettings  bool                                `json:"-"`
 }
 
 func (o *ConfigPostgresUpdateInput) UnmarshalGQL(v interface{}) error {
@@ -11493,7 +11815,7 @@ func (o *ConfigPostgresUpdateInput) UnmarshalGQL(v interface{}) error {
 	}
 	if x, ok := m["resources"]; ok {
 		if x != nil {
-			t := &ConfigResourcesUpdateInput{}
+			t := &ConfigPostgresResourcesUpdateInput{}
 			if err := t.UnmarshalGQL(x); err != nil {
 				return err
 			}
@@ -11529,7 +11851,7 @@ func (o *ConfigPostgresUpdateInput) GetVersion() *string {
 	return o.Version
 }
 
-func (o *ConfigPostgresUpdateInput) GetResources() *ConfigResourcesUpdateInput {
+func (o *ConfigPostgresUpdateInput) GetResources() *ConfigPostgresResourcesUpdateInput {
 	if o == nil {
 		return nil
 	}
@@ -11555,7 +11877,7 @@ func (s *ConfigPostgres) Update(v *ConfigPostgresUpdateInput) {
 			s.Resources = nil
 		} else {
 			if s.Resources == nil {
-				s.Resources = &ConfigResources{}
+				s.Resources = &ConfigPostgresResources{}
 			}
 			s.Resources.Update(v.Resources)
 		}
@@ -11572,88 +11894,405 @@ func (s *ConfigPostgres) Update(v *ConfigPostgresUpdateInput) {
 	}
 }
 
-type ConfigPostgresInsertInput struct {
-	Version   *string                            `json:"version,omitempty" toml:"version,omitempty"`
-	Resources *ConfigResourcesInsertInput        `json:"resources,omitempty" toml:"resources,omitempty"`
-	Settings  *ConfigPostgresSettingsInsertInput `json:"settings,omitempty" toml:"settings,omitempty"`
+type ConfigPostgresInsertInput struct {
+	Version   *string                             `json:"version,omitempty" toml:"version,omitempty"`
+	Resources *ConfigPostgresResourcesInsertInput `json:"resources,omitempty" toml:"resources,omitempty"`
+	Settings  *ConfigPostgresSettingsInsertInput  `json:"settings,omitempty" toml:"settings,omitempty"`
+}
+
+func (o *ConfigPostgresInsertInput) GetVersion() *string {
+	if o == nil {
+		o = &ConfigPostgresInsertInput{}
+	}
+	return o.Version
+}
+
+func (o *ConfigPostgresInsertInput) GetResources() *ConfigPostgresResourcesInsertInput {
+	if o == nil {
+		return nil
+	}
+	return o.Resources
+}
+
+func (o *ConfigPostgresInsertInput) GetSettings() *ConfigPostgresSettingsInsertInput {
+	if o == nil {
+		return nil
+	}
+	return o.Settings
+}
+
+func (s *ConfigPostgres) Insert(v *ConfigPostgresInsertInput) {
+	s.Version = v.Version
+	if v.Resources != nil {
+		if s.Resources == nil {
+			s.Resources = &ConfigPostgresResources{}
+		}
+		s.Resources.Insert(v.Resources)
+	}
+	if v.Settings != nil {
+		if s.Settings == nil {
+			s.Settings = &ConfigPostgresSettings{}
+		}
+		s.Settings.Insert(v.Settings)
+	}
+}
+
+func (s *ConfigPostgres) Clone() *ConfigPostgres {
+	if s == nil {
+		return nil
+	}
+
+	v := &ConfigPostgres{}
+	v.Version = s.Version
+	v.Resources = s.Resources.Clone()
+	v.Settings = s.Settings.Clone()
+	return v
+}
+
+type ConfigPostgresComparisonExp struct {
+	And       []*ConfigPostgresComparisonExp        `json:"_and,omitempty"`
+	Not       *ConfigPostgresComparisonExp          `json:"_not,omitempty"`
+	Or        []*ConfigPostgresComparisonExp        `json:"_or,omitempty"`
+	Version   *ConfigStringComparisonExp            `json:"version,omitempty"`
+	Resources *ConfigPostgresResourcesComparisonExp `json:"resources,omitempty"`
+	Settings  *ConfigPostgresSettingsComparisonExp  `json:"settings,omitempty"`
+}
+
+func (exp *ConfigPostgresComparisonExp) Matches(o *ConfigPostgres) bool {
+	if exp == nil {
+		return true
+	}
+
+	if o == nil {
+		o = &ConfigPostgres{
+			Resources: &ConfigPostgresResources{},
+			Settings:  &ConfigPostgresSettings{},
+		}
+	}
+	if o.Version != nil && !exp.Version.Matches(*o.Version) {
+		return false
+	}
+	if !exp.Resources.Matches(o.Resources) {
+		return false
+	}
+	if !exp.Settings.Matches(o.Settings) {
+		return false
+	}
+
+	if exp.And != nil && !all(exp.And, o) {
+		return false
+	}
+
+	if exp.Or != nil && !or(exp.Or, o) {
+		return false
+	}
+
+	if exp.Not != nil && exp.Not.Matches(o) {
+		return false
+	}
+
+	return true
+}
+
+// Resources for the service
+type ConfigPostgresResources struct {
+	Compute *ConfigResourcesCompute `json:"compute,omitempty" toml:"compute,omitempty"`
+	// Number of replicas for a service
+	Replicas *uint8 `json:"replicas" toml:"replicas"`
+
+	Networking *ConfigNetworking `json:"networking,omitempty" toml:"networking,omitempty"`
+
+	Storage *ConfigPostgresStorage `json:"storage,omitempty" toml:"storage,omitempty"`
+}
+
+func (o *ConfigPostgresResources) MarshalJSON() ([]byte, error) {
+	m := make(map[string]any)
+	if o.Compute != nil {
+		m["compute"] = o.Compute
+	}
+	if o.Replicas != nil {
+		m["replicas"] = o.Replicas
+	}
+	if o.Networking != nil {
+		m["networking"] = o.Networking
+	}
+	if o.Storage != nil {
+		m["storage"] = o.Storage
+	}
+	return json.Marshal(m)
+}
+
+func (o *ConfigPostgresResources) GetCompute() *ConfigResourcesCompute {
+	if o == nil {
+		return nil
+	}
+	return o.Compute
+}
+
+func (o *ConfigPostgresResources) GetReplicas() *uint8 {
+	if o == nil {
+		o = &ConfigPostgresResources{}
+	}
+	return o.Replicas
+}
+
+func (o *ConfigPostgresResources) GetNetworking() *ConfigNetworking {
+	if o == nil {
+		return nil
+	}
+	return o.Networking
+}
+
+func (o *ConfigPostgresResources) GetStorage() *ConfigPostgresStorage {
+	if o == nil {
+		return nil
+	}
+	return o.Storage
+}
+
+type ConfigPostgresResourcesUpdateInput struct {
+	Compute         *ConfigResourcesComputeUpdateInput `json:"compute,omitempty" toml:"compute,omitempty"`
+	IsSetCompute    bool                               `json:"-"`
+	Replicas        *uint8                             `json:"replicas,omitempty" toml:"replicas,omitempty"`
+	IsSetReplicas   bool                               `json:"-"`
+	Networking      *ConfigNetworkingUpdateInput       `json:"networking,omitempty" toml:"networking,omitempty"`
+	IsSetNetworking bool                               `json:"-"`
+	Storage         *ConfigPostgresStorageUpdateInput  `json:"storage,omitempty" toml:"storage,omitempty"`
+	IsSetStorage    bool                               `json:"-"`
+}
+
+func (o *ConfigPostgresResourcesUpdateInput) UnmarshalGQL(v interface{}) error {
+	m, ok := v.(map[string]any)
+	if !ok {
+		return fmt.Errorf("must be map[string]interface{}, got %T", v)
+	}
+	if x, ok := m["compute"]; ok {
+		if x != nil {
+			t := &ConfigResourcesComputeUpdateInput{}
+			if err := t.UnmarshalGQL(x); err != nil {
+				return err
+			}
+			o.Compute = t
+		}
+		o.IsSetCompute = true
+	}
+	if v, ok := m["replicas"]; ok {
+		if v == nil {
+			o.Replicas = nil
+		} else {
+			// clearly a not very efficient shortcut
+			b, err := json.Marshal(v)
+			if err != nil {
+				return err
+			}
+			var x uint8
+			if err := json.Unmarshal(b, &x); err != nil {
+				return err
+			}
+			o.Replicas = &x
+		}
+		o.IsSetReplicas = true
+	}
+	if x, ok := m["networking"]; ok {
+		if x != nil {
+			t := &ConfigNetworkingUpdateInput{}
+			if err := t.UnmarshalGQL(x); err != nil {
+				return err
+			}
+			o.Networking = t
+		}
+		o.IsSetNetworking = true
+	}
+	if x, ok := m["storage"]; ok {
+		if x != nil {
+			t := &ConfigPostgresStorageUpdateInput{}
+			if err := t.UnmarshalGQL(x); err != nil {
+				return err
+			}
+			o.Storage = t
+		}
+		o.IsSetStorage = true
+	}
+
+	return nil
+}
+
+func (o *ConfigPostgresResourcesUpdateInput) MarshalGQL(w io.Writer) {
+	enc := json.NewEncoder(w)
+	if err := enc.Encode(o); err != nil {
+		panic(err)
+	}
+}
+
+func (o *ConfigPostgresResourcesUpdateInput) GetCompute() *ConfigResourcesComputeUpdateInput {
+	if o == nil {
+		return nil
+	}
+	return o.Compute
+}
+
+func (o *ConfigPostgresResourcesUpdateInput) GetReplicas() *uint8 {
+	if o == nil {
+		o = &ConfigPostgresResourcesUpdateInput{}
+	}
+	return o.Replicas
+}
+
+func (o *ConfigPostgresResourcesUpdateInput) GetNetworking() *ConfigNetworkingUpdateInput {
+	if o == nil {
+		return nil
+	}
+	return o.Networking
+}
+
+func (o *ConfigPostgresResourcesUpdateInput) GetStorage() *ConfigPostgresStorageUpdateInput {
+	if o == nil {
+		return nil
+	}
+	return o.Storage
+}
+
+func (s *ConfigPostgresResources) Update(v *ConfigPostgresResourcesUpdateInput) {
+	if v == nil {
+		return
+	}
+	if v.IsSetCompute || v.Compute != nil {
+		if v.Compute == nil {
+			s.Compute = nil
+		} else {
+			if s.Compute == nil {
+				s.Compute = &ConfigResourcesCompute{}
+			}
+			s.Compute.Update(v.Compute)
+		}
+	}
+	if v.IsSetReplicas || v.Replicas != nil {
+		s.Replicas = v.Replicas
+	}
+	if v.IsSetNetworking || v.Networking != nil {
+		if v.Networking == nil {
+			s.Networking = nil
+		} else {
+			if s.Networking == nil {
+				s.Networking = &ConfigNetworking{}
+			}
+			s.Networking.Update(v.Networking)
+		}
+	}
+	if v.IsSetStorage || v.Storage != nil {
+		if v.Storage == nil {
+			s.Storage = nil
+		} else {
+			if s.Storage == nil {
+				s.Storage = &ConfigPostgresStorage{}
+			}
+			s.Storage.Update(v.Storage)
+		}
+	}
+}
+
+type ConfigPostgresResourcesInsertInput struct {
+	Compute    *ConfigResourcesComputeInsertInput `json:"compute,omitempty" toml:"compute,omitempty"`
+	Replicas   *uint8                             `json:"replicas,omitempty" toml:"replicas,omitempty"`
+	Networking *ConfigNetworkingInsertInput       `json:"networking,omitempty" toml:"networking,omitempty"`
+	Storage    *ConfigPostgresStorageInsertInput  `json:"storage,omitempty" toml:"storage,omitempty"`
+}
+
+func (o *ConfigPostgresResourcesInsertInput) GetCompute() *ConfigResourcesComputeInsertInput {
+	if o == nil {
+		return nil
+	}
+	return o.Compute
 }
 
-func (o *ConfigPostgresInsertInput) GetVersion() *string {
+func (o *ConfigPostgresResourcesInsertInput) GetReplicas() *uint8 {
 	if o == nil {
-		o = &ConfigPostgresInsertInput{}
+		o = &ConfigPostgresResourcesInsertInput{}
 	}
-	return o.Version
+	return o.Replicas
 }
 
-func (o *ConfigPostgresInsertInput) GetResources() *ConfigResourcesInsertInput {
+func (o *ConfigPostgresResourcesInsertInput) GetNetworking() *ConfigNetworkingInsertInput {
 	if o == nil {
 		return nil
 	}
-	return o.Resources
+	return o.Networking
 }
 
-func (o *ConfigPostgresInsertInput) GetSettings() *ConfigPostgresSettingsInsertInput {
+func (o *ConfigPostgresResourcesInsertInput) GetStorage() *ConfigPostgresStorageInsertInput {
 	if o == nil {
 		return nil
 	}
-	return o.Settings
+	return o.Storage
 }
 
-func (s *ConfigPostgres) Insert(v *ConfigPostgresInsertInput) {
-	s.Version = v.Version
-	if v.Resources != nil {
-		if s.Resources == nil {
-			s.Resources = &ConfigResources{}
+func (s *ConfigPostgresResources) Insert(v *ConfigPostgresResourcesInsertInput) {
+	if v.Compute != nil {
+		if s.Compute == nil {
+			s.Compute = &ConfigResourcesCompute{}
 		}
-		s.Resources.Insert(v.Resources)
+		s.Compute.Insert(v.Compute)
 	}
-	if v.Settings != nil {
-		if s.Settings == nil {
-			s.Settings = &ConfigPostgresSettings{}
+	s.Replicas = v.Replicas
+	if v.Networking != nil {
+		if s.Networking == nil {
+			s.Networking = &ConfigNetworking{}
 		}
-		s.Settings.Insert(v.Settings)
+		s.Networking.Insert(v.Networking)
+	}
+	if v.Storage != nil {
+		if s.Storage == nil {
+			s.Storage = &ConfigPostgresStorage{}
+		}
+		s.Storage.Insert(v.Storage)
 	}
 }
 
-func (s *ConfigPostgres) Clone() *ConfigPostgres {
+func (s *ConfigPostgresResources) Clone() *ConfigPostgresResources {
 	if s == nil {
 		return nil
 	}
 
-	v := &ConfigPostgres{}
-	v.Version = s.Version
-	v.Resources = s.Resources.Clone()
-	v.Settings = s.Settings.Clone()
+	v := &ConfigPostgresResources{}
+	v.Compute = s.Compute.Clone()
+	v.Replicas = s.Replicas
+	v.Networking = s.Networking.Clone()
+	v.Storage = s.Storage.Clone()
 	return v
 }
 
-type ConfigPostgresComparisonExp struct {
-	And       []*ConfigPostgresComparisonExp       `json:"_and,omitempty"`
-	Not       *ConfigPostgresComparisonExp         `json:"_not,omitempty"`
-	Or        []*ConfigPostgresComparisonExp       `json:"_or,omitempty"`
-	Version   *ConfigStringComparisonExp           `json:"version,omitempty"`
-	Resources *ConfigResourcesComparisonExp        `json:"resources,omitempty"`
-	Settings  *ConfigPostgresSettingsComparisonExp `json:"settings,omitempty"`
+type ConfigPostgresResourcesComparisonExp struct {
+	And        []*ConfigPostgresResourcesComparisonExp `json:"_and,omitempty"`
+	Not        *ConfigPostgresResourcesComparisonExp   `json:"_not,omitempty"`
+	Or         []*ConfigPostgresResourcesComparisonExp `json:"_or,omitempty"`
+	Compute    *ConfigResourcesComputeComparisonExp    `json:"compute,omitempty"`
+	Replicas   *ConfigUint8ComparisonExp               `json:"replicas,omitempty"`
+	Networking *ConfigNetworkingComparisonExp          `json:"networking,omitempty"`
+	Storage    *ConfigPostgresStorageComparisonExp     `json:"storage,omitempty"`
 }
 
-func (exp *ConfigPostgresComparisonExp) Matches(o *ConfigPostgres) bool {
+func (exp *ConfigPostgresResourcesComparisonExp) Matches(o *ConfigPostgresResources) bool {
 	if exp == nil {
 		return true
 	}
 
 	if o == nil {
-		o = &ConfigPostgres{
-			Resources: &ConfigResources{},
-			Settings:  &ConfigPostgresSettings{},
+		o = &ConfigPostgresResources{
+			Compute:    &ConfigResourcesCompute{},
+			Networking: &ConfigNetworking{},
+			Storage:    &ConfigPostgresStorage{},
 		}
 	}
-	if o.Version != nil && !exp.Version.Matches(*o.Version) {
+	if !exp.Compute.Matches(o.Compute) {
 		return false
 	}
-	if !exp.Resources.Matches(o.Resources) {
+	if o.Replicas != nil && !exp.Replicas.Matches(*o.Replicas) {
 		return false
 	}
-	if !exp.Settings.Matches(o.Settings) {
+	if !exp.Networking.Matches(o.Networking) {
+		return false
+	}
+	if !exp.Storage.Matches(o.Storage) {
 		return false
 	}
 
@@ -12739,6 +13378,139 @@ func (exp *ConfigPostgresSettingsComparisonExp) Matches(o *ConfigPostgresSetting
 	return true
 }
 
+type ConfigPostgresStorage struct {
+	// GiB
+	Capacity uint32 `json:"capacity" toml:"capacity"`
+}
+
+func (o *ConfigPostgresStorage) MarshalJSON() ([]byte, error) {
+	m := make(map[string]any)
+	m["capacity"] = o.Capacity
+	return json.Marshal(m)
+}
+
+func (o *ConfigPostgresStorage) GetCapacity() uint32 {
+	if o == nil {
+		o = &ConfigPostgresStorage{}
+	}
+	return o.Capacity
+}
+
+type ConfigPostgresStorageUpdateInput struct {
+	Capacity      *uint32 `json:"capacity,omitempty" toml:"capacity,omitempty"`
+	IsSetCapacity bool    `json:"-"`
+}
+
+func (o *ConfigPostgresStorageUpdateInput) UnmarshalGQL(v interface{}) error {
+	m, ok := v.(map[string]any)
+	if !ok {
+		return fmt.Errorf("must be map[string]interface{}, got %T", v)
+	}
+	if v, ok := m["capacity"]; ok {
+		if v == nil {
+			o.Capacity = nil
+		} else {
+			// clearly a not very efficient shortcut
+			b, err := json.Marshal(v)
+			if err != nil {
+				return err
+			}
+			var x uint32
+			if err := json.Unmarshal(b, &x); err != nil {
+				return err
+			}
+			o.Capacity = &x
+		}
+		o.IsSetCapacity = true
+	}
+
+	return nil
+}
+
+func (o *ConfigPostgresStorageUpdateInput) MarshalGQL(w io.Writer) {
+	enc := json.NewEncoder(w)
+	if err := enc.Encode(o); err != nil {
+		panic(err)
+	}
+}
+
+func (o *ConfigPostgresStorageUpdateInput) GetCapacity() *uint32 {
+	if o == nil {
+		o = &ConfigPostgresStorageUpdateInput{}
+	}
+	return o.Capacity
+}
+
+func (s *ConfigPostgresStorage) Update(v *ConfigPostgresStorageUpdateInput) {
+	if v == nil {
+		return
+	}
+	if v.IsSetCapacity || v.Capacity != nil {
+		if v.Capacity != nil {
+			s.Capacity = *v.Capacity
+		}
+	}
+}
+
+type ConfigPostgresStorageInsertInput struct {
+	Capacity uint32 `json:"capacity,omitempty" toml:"capacity,omitempty"`
+}
+
+func (o *ConfigPostgresStorageInsertInput) GetCapacity() uint32 {
+	if o == nil {
+		o = &ConfigPostgresStorageInsertInput{}
+	}
+	return o.Capacity
+}
+
+func (s *ConfigPostgresStorage) Insert(v *ConfigPostgresStorageInsertInput) {
+	s.Capacity = v.Capacity
+}
+
+func (s *ConfigPostgresStorage) Clone() *ConfigPostgresStorage {
+	if s == nil {
+		return nil
+	}
+
+	v := &ConfigPostgresStorage{}
+	v.Capacity = s.Capacity
+	return v
+}
+
+type ConfigPostgresStorageComparisonExp struct {
+	And      []*ConfigPostgresStorageComparisonExp `json:"_and,omitempty"`
+	Not      *ConfigPostgresStorageComparisonExp   `json:"_not,omitempty"`
+	Or       []*ConfigPostgresStorageComparisonExp `json:"_or,omitempty"`
+	Capacity *ConfigUint32ComparisonExp            `json:"capacity,omitempty"`
+}
+
+func (exp *ConfigPostgresStorageComparisonExp) Matches(o *ConfigPostgresStorage) bool {
+	if exp == nil {
+		return true
+	}
+
+	if o == nil {
+		o = &ConfigPostgresStorage{}
+	}
+	if !exp.Capacity.Matches(o.Capacity) {
+		return false
+	}
+
+	if exp.And != nil && !all(exp.And, o) {
+		return false
+	}
+
+	if exp.Or != nil && !or(exp.Or, o) {
+		return false
+	}
+
+	if exp.Not != nil && exp.Not.Matches(o) {
+		return false
+	}
+
+	return true
+}
+
 type ConfigProvider struct {
 	Smtp *ConfigSmtp `json:"smtp,omitempty" toml:"smtp,omitempty"`
 
@@ -12943,7 +13715,9 @@ func (exp *ConfigProviderComparisonExp) Matches(o *ConfigProvider) bool {
 type ConfigResources struct {
 	Compute *ConfigResourcesCompute `json:"compute,omitempty" toml:"compute,omitempty"`
 	// Number of replicas for a service
-	Replicas uint8 `json:"replicas" toml:"replicas"`
+	Replicas *uint8 `json:"replicas" toml:"replicas"`
+
+	Networking *ConfigNetworking `json:"networking,omitempty" toml:"networking,omitempty"`
 }
 
 func (o *ConfigResources) MarshalJSON() ([]byte, error) {
@@ -12951,7 +13725,12 @@ func (o *ConfigResources) MarshalJSON() ([]byte, error) {
 	if o.Compute != nil {
 		m["compute"] = o.Compute
 	}
-	m["replicas"] = o.Replicas
+	if o.Replicas != nil {
+		m["replicas"] = o.Replicas
+	}
+	if o.Networking != nil {
+		m["networking"] = o.Networking
+	}
 	return json.Marshal(m)
 }
 
@@ -12962,18 +13741,27 @@ func (o *ConfigResources) GetCompute() *ConfigResourcesCompute {
 	return o.Compute
 }
 
-func (o *ConfigResources) GetReplicas() uint8 {
+func (o *ConfigResources) GetReplicas() *uint8 {
 	if o == nil {
 		o = &ConfigResources{}
 	}
 	return o.Replicas
 }
 
+func (o *ConfigResources) GetNetworking() *ConfigNetworking {
+	if o == nil {
+		return nil
+	}
+	return o.Networking
+}
+
 type ConfigResourcesUpdateInput struct {
-	Compute       *ConfigResourcesComputeUpdateInput `json:"compute,omitempty" toml:"compute,omitempty"`
-	IsSetCompute  bool                               `json:"-"`
-	Replicas      *uint8                             `json:"replicas,omitempty" toml:"replicas,omitempty"`
-	IsSetReplicas bool                               `json:"-"`
+	Compute         *ConfigResourcesComputeUpdateInput `json:"compute,omitempty" toml:"compute,omitempty"`
+	IsSetCompute    bool                               `json:"-"`
+	Replicas        *uint8                             `json:"replicas,omitempty" toml:"replicas,omitempty"`
+	IsSetReplicas   bool                               `json:"-"`
+	Networking      *ConfigNetworkingUpdateInput       `json:"networking,omitempty" toml:"networking,omitempty"`
+	IsSetNetworking bool                               `json:"-"`
 }
 
 func (o *ConfigResourcesUpdateInput) UnmarshalGQL(v interface{}) error {
@@ -13008,6 +13796,16 @@ func (o *ConfigResourcesUpdateInput) UnmarshalGQL(v interface{}) error {
 		}
 		o.IsSetReplicas = true
 	}
+	if x, ok := m["networking"]; ok {
+		if x != nil {
+			t := &ConfigNetworkingUpdateInput{}
+			if err := t.UnmarshalGQL(x); err != nil {
+				return err
+			}
+			o.Networking = t
+		}
+		o.IsSetNetworking = true
+	}
 
 	return nil
 }
@@ -13033,6 +13831,13 @@ func (o *ConfigResourcesUpdateInput) GetReplicas() *uint8 {
 	return o.Replicas
 }
 
+func (o *ConfigResourcesUpdateInput) GetNetworking() *ConfigNetworkingUpdateInput {
+	if o == nil {
+		return nil
+	}
+	return o.Networking
+}
+
 func (s *ConfigResources) Update(v *ConfigResourcesUpdateInput) {
 	if v == nil {
 		return
@@ -13048,15 +13853,24 @@ func (s *ConfigResources) Update(v *ConfigResourcesUpdateInput) {
 		}
 	}
 	if v.IsSetReplicas || v.Replicas != nil {
-		if v.Replicas != nil {
-			s.Replicas = *v.Replicas
+		s.Replicas = v.Replicas
+	}
+	if v.IsSetNetworking || v.Networking != nil {
+		if v.Networking == nil {
+			s.Networking = nil
+		} else {
+			if s.Networking == nil {
+				s.Networking = &ConfigNetworking{}
+			}
+			s.Networking.Update(v.Networking)
 		}
 	}
 }
 
 type ConfigResourcesInsertInput struct {
-	Compute  *ConfigResourcesComputeInsertInput `json:"compute,omitempty" toml:"compute,omitempty"`
-	Replicas uint8                              `json:"replicas,omitempty" toml:"replicas,omitempty"`
+	Compute    *ConfigResourcesComputeInsertInput `json:"compute,omitempty" toml:"compute,omitempty"`
+	Replicas   *uint8                             `json:"replicas,omitempty" toml:"replicas,omitempty"`
+	Networking *ConfigNetworkingInsertInput       `json:"networking,omitempty" toml:"networking,omitempty"`
 }
 
 func (o *ConfigResourcesInsertInput) GetCompute() *ConfigResourcesComputeInsertInput {
@@ -13066,13 +13880,20 @@ func (o *ConfigResourcesInsertInput) GetCompute() *ConfigResourcesComputeInsertI
 	return o.Compute
 }
 
-func (o *ConfigResourcesInsertInput) GetReplicas() uint8 {
+func (o *ConfigResourcesInsertInput) GetReplicas() *uint8 {
 	if o == nil {
 		o = &ConfigResourcesInsertInput{}
 	}
 	return o.Replicas
 }
 
+func (o *ConfigResourcesInsertInput) GetNetworking() *ConfigNetworkingInsertInput {
+	if o == nil {
+		return nil
+	}
+	return o.Networking
+}
+
 func (s *ConfigResources) Insert(v *ConfigResourcesInsertInput) {
 	if v.Compute != nil {
 		if s.Compute == nil {
@@ -13081,6 +13902,12 @@ func (s *ConfigResources) Insert(v *ConfigResourcesInsertInput) {
 		s.Compute.Insert(v.Compute)
 	}
 	s.Replicas = v.Replicas
+	if v.Networking != nil {
+		if s.Networking == nil {
+			s.Networking = &ConfigNetworking{}
+		}
+		s.Networking.Insert(v.Networking)
+	}
 }
 
 func (s *ConfigResources) Clone() *ConfigResources {
@@ -13091,15 +13918,17 @@ func (s *ConfigResources) Clone() *ConfigResources {
 	v := &ConfigResources{}
 	v.Compute = s.Compute.Clone()
 	v.Replicas = s.Replicas
+	v.Networking = s.Networking.Clone()
 	return v
 }
 
 type ConfigResourcesComparisonExp struct {
-	And      []*ConfigResourcesComparisonExp      `json:"_and,omitempty"`
-	Not      *ConfigResourcesComparisonExp        `json:"_not,omitempty"`
-	Or       []*ConfigResourcesComparisonExp      `json:"_or,omitempty"`
-	Compute  *ConfigResourcesComputeComparisonExp `json:"compute,omitempty"`
-	Replicas *ConfigUint8ComparisonExp            `json:"replicas,omitempty"`
+	And        []*ConfigResourcesComparisonExp      `json:"_and,omitempty"`
+	Not        *ConfigResourcesComparisonExp        `json:"_not,omitempty"`
+	Or         []*ConfigResourcesComparisonExp      `json:"_or,omitempty"`
+	Compute    *ConfigResourcesComputeComparisonExp `json:"compute,omitempty"`
+	Replicas   *ConfigUint8ComparisonExp            `json:"replicas,omitempty"`
+	Networking *ConfigNetworkingComparisonExp       `json:"networking,omitempty"`
 }
 
 func (exp *ConfigResourcesComparisonExp) Matches(o *ConfigResources) bool {
@@ -13109,13 +13938,17 @@ func (exp *ConfigResourcesComparisonExp) Matches(o *ConfigResources) bool {
 
 	if o == nil {
 		o = &ConfigResources{
-			Compute: &ConfigResourcesCompute{},
+			Compute:    &ConfigResourcesCompute{},
+			Networking: &ConfigNetworking{},
 		}
 	}
 	if !exp.Compute.Matches(o.Compute) {
 		return false
 	}
-	if !exp.Replicas.Matches(o.Replicas) {
+	if o.Replicas != nil && !exp.Replicas.Matches(*o.Replicas) {
+		return false
+	}
+	if !exp.Networking.Matches(o.Networking) {
 		return false
 	}
 
@@ -14000,6 +14833,8 @@ type ConfigRunServicePort struct {
 	Type string `json:"type" toml:"type"`
 
 	Publish *bool `json:"publish" toml:"publish"`
+
+	Ingresses []*ConfigIngress `json:"ingresses,omitempty" toml:"ingresses,omitempty"`
 }
 
 func (o *ConfigRunServicePort) MarshalJSON() ([]byte, error) {
@@ -14009,6 +14844,9 @@ func (o *ConfigRunServicePort) MarshalJSON() ([]byte, error) {
 	if o.Publish != nil {
 		m["publish"] = o.Publish
 	}
+	if o.Ingresses != nil {
+		m["ingresses"] = o.Ingresses
+	}
 	return json.Marshal(m)
 }
 
@@ -14033,13 +14871,22 @@ func (o *ConfigRunServicePort) GetPublish() *bool {
 	return o.Publish
 }
 
+func (o *ConfigRunServicePort) GetIngresses() []*ConfigIngress {
+	if o == nil {
+		o = &ConfigRunServicePort{}
+	}
+	return o.Ingresses
+}
+
 type ConfigRunServicePortUpdateInput struct {
-	Port         *uint16 `json:"port,omitempty" toml:"port,omitempty"`
-	IsSetPort    bool    `json:"-"`
-	Type         *string `json:"type,omitempty" toml:"type,omitempty"`
-	IsSetType    bool    `json:"-"`
-	Publish      *bool   `json:"publish,omitempty" toml:"publish,omitempty"`
-	IsSetPublish bool    `json:"-"`
+	Port           *uint16                     `json:"port,omitempty" toml:"port,omitempty"`
+	IsSetPort      bool                        `json:"-"`
+	Type           *string                     `json:"type,omitempty" toml:"type,omitempty"`
+	IsSetType      bool                        `json:"-"`
+	Publish        *bool                       `json:"publish,omitempty" toml:"publish,omitempty"`
+	IsSetPublish   bool                        `json:"-"`
+	Ingresses      []*ConfigIngressUpdateInput `json:"ingresses,omitempty" toml:"ingresses,omitempty"`
+	IsSetIngresses bool                        `json:"-"`
 }
 
 func (o *ConfigRunServicePortUpdateInput) UnmarshalGQL(v interface{}) error {
@@ -14098,6 +14945,25 @@ func (o *ConfigRunServicePortUpdateInput) UnmarshalGQL(v interface{}) error {
 		}
 		o.IsSetPublish = true
 	}
+	if v, ok := m["ingresses"]; ok {
+		if v != nil {
+			x, ok := v.([]interface{})
+			if !ok {
+				return fmt.Errorf("Ingresses must be []interface{}, got %T", v)
+			}
+
+			l := make([]*ConfigIngressUpdateInput, len(x))
+			for i, vv := range x {
+				t := &ConfigIngressUpdateInput{}
+				if err := t.UnmarshalGQL(vv); err != nil {
+					return err
+				}
+				l[i] = t
+			}
+			o.Ingresses = l
+		}
+		o.IsSetIngresses = true
+	}
 
 	return nil
 }
@@ -14130,6 +14996,13 @@ func (o *ConfigRunServicePortUpdateInput) GetPublish() *bool {
 	return o.Publish
 }
 
+func (o *ConfigRunServicePortUpdateInput) GetIngresses() []*ConfigIngressUpdateInput {
+	if o == nil {
+		o = &ConfigRunServicePortUpdateInput{}
+	}
+	return o.Ingresses
+}
+
 func (s *ConfigRunServicePort) Update(v *ConfigRunServicePortUpdateInput) {
 	if v == nil {
 		return
@@ -14147,12 +15020,25 @@ func (s *ConfigRunServicePort) Update(v *ConfigRunServicePortUpdateInput) {
 	if v.IsSetPublish || v.Publish != nil {
 		s.Publish = v.Publish
 	}
+	if v.IsSetIngresses || v.Ingresses != nil {
+		if v.Ingresses == nil {
+			s.Ingresses = nil
+		} else {
+			s.Ingresses = make([]*ConfigIngress, len(v.Ingresses))
+			for i, e := range v.Ingresses {
+				v := &ConfigIngress{}
+				v.Update(e)
+				s.Ingresses[i] = v
+			}
+		}
+	}
 }
 
 type ConfigRunServicePortInsertInput struct {
-	Port    uint16 `json:"port,omitempty" toml:"port,omitempty"`
-	Type    string `json:"type,omitempty" toml:"type,omitempty"`
-	Publish *bool  `json:"publish,omitempty" toml:"publish,omitempty"`
+	Port      uint16                      `json:"port,omitempty" toml:"port,omitempty"`
+	Type      string                      `json:"type,omitempty" toml:"type,omitempty"`
+	Publish   *bool                       `json:"publish,omitempty" toml:"publish,omitempty"`
+	Ingresses []*ConfigIngressInsertInput `json:"ingresses,omitempty" toml:"ingresses,omitempty"`
 }
 
 func (o *ConfigRunServicePortInsertInput) GetPort() uint16 {
@@ -14176,10 +15062,25 @@ func (o *ConfigRunServicePortInsertInput) GetPublish() *bool {
 	return o.Publish
 }
 
+func (o *ConfigRunServicePortInsertInput) GetIngresses() []*ConfigIngressInsertInput {
+	if o == nil {
+		o = &ConfigRunServicePortInsertInput{}
+	}
+	return o.Ingresses
+}
+
 func (s *ConfigRunServicePort) Insert(v *ConfigRunServicePortInsertInput) {
 	s.Port = v.Port
 	s.Type = v.Type
 	s.Publish = v.Publish
+	if v.Ingresses != nil {
+		s.Ingresses = make([]*ConfigIngress, len(v.Ingresses))
+		for i, e := range v.Ingresses {
+			v := &ConfigIngress{}
+			v.Insert(e)
+			s.Ingresses[i] = v
+		}
+	}
 }
 
 func (s *ConfigRunServicePort) Clone() *ConfigRunServicePort {
@@ -14191,16 +15092,23 @@ func (s *ConfigRunServicePort) Clone() *ConfigRunServicePort {
 	v.Port = s.Port
 	v.Type = s.Type
 	v.Publish = s.Publish
+	if s.Ingresses != nil {
+		v.Ingresses = make([]*ConfigIngress, len(s.Ingresses))
+		for i, e := range s.Ingresses {
+			v.Ingresses[i] = e.Clone()
+		}
+	}
 	return v
 }
 
 type ConfigRunServicePortComparisonExp struct {
-	And     []*ConfigRunServicePortComparisonExp `json:"_and,omitempty"`
-	Not     *ConfigRunServicePortComparisonExp   `json:"_not,omitempty"`
-	Or      []*ConfigRunServicePortComparisonExp `json:"_or,omitempty"`
-	Port    *ConfigPortComparisonExp             `json:"port,omitempty"`
-	Type    *ConfigStringComparisonExp           `json:"type,omitempty"`
-	Publish *ConfigBooleanComparisonExp          `json:"publish,omitempty"`
+	And       []*ConfigRunServicePortComparisonExp `json:"_and,omitempty"`
+	Not       *ConfigRunServicePortComparisonExp   `json:"_not,omitempty"`
+	Or        []*ConfigRunServicePortComparisonExp `json:"_or,omitempty"`
+	Port      *ConfigPortComparisonExp             `json:"port,omitempty"`
+	Type      *ConfigStringComparisonExp           `json:"type,omitempty"`
+	Publish   *ConfigBooleanComparisonExp          `json:"publish,omitempty"`
+	Ingresses *ConfigIngressComparisonExp          `json:"ingresses,omitempty"`
 }
 
 func (exp *ConfigRunServicePortComparisonExp) Matches(o *ConfigRunServicePort) bool {
@@ -14209,7 +15117,9 @@ func (exp *ConfigRunServicePortComparisonExp) Matches(o *ConfigRunServicePort) b
 	}
 
 	if o == nil {
-		o = &ConfigRunServicePort{}
+		o = &ConfigRunServicePort{
+			Ingresses: []*ConfigIngress{},
+		}
 	}
 	if !exp.Port.Matches(o.Port) {
 		return false
@@ -14220,6 +15130,18 @@ func (exp *ConfigRunServicePortComparisonExp) Matches(o *ConfigRunServicePort) b
 	if o.Publish != nil && !exp.Publish.Matches(*o.Publish) {
 		return false
 	}
+	{
+		found := false
+		for _, o := range o.Ingresses {
+			if exp.Ingresses.Matches(o) {
+				found = true
+				break
+			}
+		}
+		if !found && exp.Ingresses != nil {
+			return false
+		}
+	}
 
 	if exp.And != nil && !all(exp.And, o) {
 		return false
@@ -16281,7 +17203,8 @@ type ConfigStorage struct {
 	//
 	// https://github.com/nhost/hasura-storage/releases
 	Version *string `json:"version" toml:"version"`
-	// Resources for the service
+	// Networking (custom domains at the moment) are not allowed as we need to do further
+	// configurations in the CDN. We will enable it again in the future.
 	Resources *ConfigResources `json:"resources,omitempty" toml:"resources,omitempty"`
 
 	Antivirus *ConfigStorageAntivirus `json:"antivirus,omitempty" toml:"antivirus,omitempty"`
diff --git a/vendor/github.com/nhost/be/services/mimir/schema/schema.cue b/vendor/github.com/nhost/be/services/mimir/schema/schema.cue
index 5399f97d5..1a85ec5aa 100644
--- a/vendor/github.com/nhost/be/services/mimir/schema/schema.cue
+++ b/vendor/github.com/nhost/be/services/mimir/schema/schema.cue
@@ -55,10 +55,12 @@ import (
 		postgres.resources.compute.cpu) >= 1000 & true @cuegraph(skip)
 
 	_validateAllResourcesAreSetOrNot: (
-						(hasura.resources == _|_) ==
-		(auth.resources == _|_) ==
-		(storage.resources == _|_) ==
-		(postgres.resources == _|_) ) & true @cuegraph(skip)
+						(hasura.resources.compute == _|_) ==
+		(auth.resources.compute == _|_) ==
+		(storage.resources.compute == _|_) ==
+		(postgres.resources.compute == _|_) ) & true @cuegraph(skip)
+
+	_validateNetworkingMustBeNullOrNotSet: !storage.resources.networking | storage.resources.networking == null @cuegraph(skip)
 }
 
 // Global configuration that applies to all services
@@ -74,9 +76,17 @@ import (
 	value: string
 }
 
+#Networking: {
+	ingresses: [#Ingress] | *[]
+}
+
+#Ingress: {
+	fqdn: [string & net.FQDN & strings.MinRunes(1) & strings.MaxRunes(63)]
+}
+
 // Resource configuration for a service
 #Resources: {
-	compute: {
+	compute?: {
 		// milicpus, 1000 milicpus = 1 cpu
 		cpu: uint32 & >=250 & <=15000
 		// MiB: 128MiB to 30GiB
@@ -90,11 +100,13 @@ import (
 	}
 
 	// Number of replicas for a service
-	replicas: uint8 & >=1 & <=10
+	replicas?: uint8 & >=1 & <=10 | *1
 
 	_validateMultipleReplicasRatioMustBe1For2: (
 							replicas == 1 |
 		(compute.cpu*2.048 == compute.memory)) & true @cuegraph(skip)
+
+	networking?: #Networking | null
 }
 
 // Configuration for hasura service
@@ -159,8 +171,9 @@ import (
 	// https://github.com/nhost/hasura-storage/releases
 	version: string | *"0.4.0"
 
-	// Resources for the service
-	resources?: #Resources
+	// Networking (custom domains at the moment) are not allowed as we need to do further
+	// configurations in the CDN. We will enable it again in the future.
+	resources?: #Resources & {networking?: null}
 
 	antivirus?: {
 		server: "tcp://run-clamav:3310"
@@ -178,11 +191,17 @@ import (
 #Postgres: {
 	// Version of postgres, you can see available versions in the URL below:
 	// https://hub.docker.com/r/nhost/postgres/tags
-	version: string | *"14.6-20230927-1"
+	version: string | *"14.6-20231018-1"
 
 	// Resources for the service
-	resources?: #Resources & {
-		replicas: 1
+	resources?: {
+		#Resources
+		storage: {
+			capacity: uint32 & >=10 & <=1000 | *10 // GiB
+		}
+	} & {
+		replicas:    1
+		networking?: null
 	}
 
 	settings?: {
@@ -521,11 +540,12 @@ import (
 	port:                              #Port
 	type:                              "http" | "tcp" | "udp"
 	publish:                           bool | *false
+	ingresses:                         [#Ingress] | *[]
 	_publish_supported_only_over_http: (
 						publish == false || type == "http" ) & true @cuegraph(skip)
 }
 
-#RunServiceName: =~"^[a-z]([-a-z0-9]*[a-z0-9])?$" & strings.MinRunes(1) & strings.MaxRunes(12)
+#RunServiceName: =~"^[a-z]([-a-z0-9]*[a-z0-9])?$" & strings.MinRunes(1) & strings.MaxRunes(30)
 
 // Resource configuration for a service
 #RunServiceResources: {
diff --git a/vendor/github.com/nhost/be/services/mimir/schema/schema_gen.graphqls b/vendor/github.com/nhost/be/services/mimir/schema/schema_gen.graphqls
index 70b7faa9d..0f8095cae 100644
--- a/vendor/github.com/nhost/be/services/mimir/schema/schema_gen.graphqls
+++ b/vendor/github.com/nhost/be/services/mimir/schema/schema_gen.graphqls
@@ -1676,6 +1676,31 @@ input ConfigHasuraSettingsComparisonExp {
     liveQueriesMultiplexedRefetchInterval: ConfigUint32ComparisonExp
 }
 
+"""
+
+"""
+type ConfigIngress {
+    """
+
+    """
+    fqdn: [String!]
+}
+
+input ConfigIngressUpdateInput {
+        fqdn: [String!]
+}
+
+input ConfigIngressInsertInput {
+        fqdn: [String!]
+}
+
+input ConfigIngressComparisonExp {
+    _and: [ConfigIngressComparisonExp!]
+    _not: ConfigIngressComparisonExp
+    _or: [ConfigIngressComparisonExp!]
+    fqdn: ConfigStringComparisonExp
+}
+
 """
 See https://hasura.io/docs/latest/auth/authentication/jwt/
 """
@@ -1782,6 +1807,31 @@ input ConfigLocaleComparisonExp {
 
 """
 
+"""
+type ConfigNetworking {
+    """
+
+    """
+    ingresses: [ConfigIngress!]
+}
+
+input ConfigNetworkingUpdateInput {
+        ingresses: [ConfigIngressUpdateInput!]
+}
+
+input ConfigNetworkingInsertInput {
+        ingresses: [ConfigIngressInsertInput!]
+}
+
+input ConfigNetworkingComparisonExp {
+    _and: [ConfigNetworkingComparisonExp!]
+    _not: ConfigNetworkingComparisonExp
+    _or: [ConfigNetworkingComparisonExp!]
+    ingresses: ConfigIngressComparisonExp
+}
+
+"""
+
 """
 type ConfigObservability {
     """
@@ -1826,7 +1876,7 @@ type ConfigPostgres {
     """
     Resources for the service
     """
-    resources: ConfigResources
+    resources: ConfigPostgresResources
     """
 
     """
@@ -1835,13 +1885,13 @@ type ConfigPostgres {
 
 input ConfigPostgresUpdateInput {
     version: String
-    resources: ConfigResourcesUpdateInput
+    resources: ConfigPostgresResourcesUpdateInput
     settings: ConfigPostgresSettingsUpdateInput
 }
 
 input ConfigPostgresInsertInput {
     version: String
-    resources: ConfigResourcesInsertInput
+    resources: ConfigPostgresResourcesInsertInput
     settings: ConfigPostgresSettingsInsertInput
 }
 
@@ -1850,10 +1900,56 @@ input ConfigPostgresComparisonExp {
     _not: ConfigPostgresComparisonExp
     _or: [ConfigPostgresComparisonExp!]
     version: ConfigStringComparisonExp
-    resources: ConfigResourcesComparisonExp
+    resources: ConfigPostgresResourcesComparisonExp
     settings: ConfigPostgresSettingsComparisonExp
 }
 
+"""
+Resources for the service
+"""
+type ConfigPostgresResources {
+    """
+
+    """
+    compute: ConfigResourcesCompute
+    """
+    Number of replicas for a service
+    """
+    replicas: ConfigUint8
+    """
+
+    """
+    networking: ConfigNetworking
+    """
+
+    """
+    storage: ConfigPostgresStorage!
+}
+
+input ConfigPostgresResourcesUpdateInput {
+    compute: ConfigResourcesComputeUpdateInput
+    replicas: ConfigUint8
+    networking: ConfigNetworkingUpdateInput
+    storage: ConfigPostgresStorageUpdateInput
+}
+
+input ConfigPostgresResourcesInsertInput {
+    compute: ConfigResourcesComputeInsertInput
+    replicas: ConfigUint8
+    networking: ConfigNetworkingInsertInput
+    storage: ConfigPostgresStorageInsertInput!
+}
+
+input ConfigPostgresResourcesComparisonExp {
+    _and: [ConfigPostgresResourcesComparisonExp!]
+    _not: ConfigPostgresResourcesComparisonExp
+    _or: [ConfigPostgresResourcesComparisonExp!]
+    compute: ConfigResourcesComputeComparisonExp
+    replicas: ConfigUint8ComparisonExp
+    networking: ConfigNetworkingComparisonExp
+    storage: ConfigPostgresStorageComparisonExp
+}
+
 """
 
 """
@@ -2000,6 +2096,31 @@ input ConfigPostgresSettingsComparisonExp {
 
 """
 
+"""
+type ConfigPostgresStorage {
+    """
+    GiB
+    """
+    capacity: ConfigUint32!
+}
+
+input ConfigPostgresStorageUpdateInput {
+    capacity: ConfigUint32
+}
+
+input ConfigPostgresStorageInsertInput {
+    capacity: ConfigUint32!
+}
+
+input ConfigPostgresStorageComparisonExp {
+    _and: [ConfigPostgresStorageComparisonExp!]
+    _not: ConfigPostgresStorageComparisonExp
+    _or: [ConfigPostgresStorageComparisonExp!]
+    capacity: ConfigUint32ComparisonExp
+}
+
+"""
+
 """
 type ConfigProvider {
     """
@@ -2037,21 +2158,27 @@ type ConfigResources {
     """
 
     """
-    compute: ConfigResourcesCompute!
+    compute: ConfigResourcesCompute
     """
     Number of replicas for a service
     """
-    replicas: ConfigUint8!
+    replicas: ConfigUint8
+    """
+
+    """
+    networking: ConfigNetworking
 }
 
 input ConfigResourcesUpdateInput {
     compute: ConfigResourcesComputeUpdateInput
     replicas: ConfigUint8
+    networking: ConfigNetworkingUpdateInput
 }
 
 input ConfigResourcesInsertInput {
-    compute: ConfigResourcesComputeInsertInput!
-    replicas: ConfigUint8!
+    compute: ConfigResourcesComputeInsertInput
+    replicas: ConfigUint8
+    networking: ConfigNetworkingInsertInput
 }
 
 input ConfigResourcesComparisonExp {
@@ -2060,6 +2187,7 @@ input ConfigResourcesComparisonExp {
     _or: [ConfigResourcesComparisonExp!]
     compute: ConfigResourcesComputeComparisonExp
     replicas: ConfigUint8ComparisonExp
+    networking: ConfigNetworkingComparisonExp
 }
 
 """
@@ -2204,18 +2332,24 @@ type ConfigRunServicePort {
 
     """
     publish: Boolean
+    """
+
+    """
+    ingresses: [ConfigIngress!]
 }
 
 input ConfigRunServicePortUpdateInput {
     port: ConfigPort
     type: String
     publish: Boolean
+        ingresses: [ConfigIngressUpdateInput!]
 }
 
 input ConfigRunServicePortInsertInput {
     port: ConfigPort!
     type: String!
     publish: Boolean
+        ingresses: [ConfigIngressInsertInput!]
 }
 
 input ConfigRunServicePortComparisonExp {
@@ -2225,6 +2359,7 @@ input ConfigRunServicePortComparisonExp {
     port: ConfigPortComparisonExp
     type: ConfigStringComparisonExp
     publish: ConfigBooleanComparisonExp
+    ingresses: ConfigIngressComparisonExp
 }
 
 """
@@ -2549,7 +2684,8 @@ type ConfigStorage {
     """
     version: String
     """
-    Resources for the service
+    Networking (custom domains at the moment) are not allowed as we need to do further
+    configurations in the CDN. We will enable it again in the future.
     """
     resources: ConfigResources
     """
diff --git a/vendor/github.com/pelletier/go-toml/v2/.goreleaser.yaml b/vendor/github.com/pelletier/go-toml/v2/.goreleaser.yaml
index 3aa1840ec..1d8b69e65 100644
--- a/vendor/github.com/pelletier/go-toml/v2/.goreleaser.yaml
+++ b/vendor/github.com/pelletier/go-toml/v2/.goreleaser.yaml
@@ -18,6 +18,7 @@ builds:
       - linux_amd64
       - linux_arm64
       - linux_arm
+      - linux_riscv64
       - windows_amd64
       - windows_arm64
       - windows_arm
@@ -37,6 +38,7 @@ builds:
       - linux_amd64
       - linux_arm64
       - linux_arm
+      - linux_riscv64
       - windows_amd64
       - windows_arm64
       - windows_arm
@@ -55,6 +57,7 @@ builds:
     targets:
       - linux_amd64
       - linux_arm64
+      - linux_riscv64
       - linux_arm
       - windows_amd64
       - windows_arm64
diff --git a/vendor/github.com/pelletier/go-toml/v2/LICENSE b/vendor/github.com/pelletier/go-toml/v2/LICENSE
index 6839d51cd..991e2ae96 100644
--- a/vendor/github.com/pelletier/go-toml/v2/LICENSE
+++ b/vendor/github.com/pelletier/go-toml/v2/LICENSE
@@ -1,6 +1,7 @@
 The MIT License (MIT)
 
-Copyright (c) 2013 - 2022 Thomas Pelletier, Eric Anderton
+go-toml v2
+Copyright (c) 2021 - 2023 Thomas Pelletier
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/vendor/github.com/pelletier/go-toml/v2/README.md b/vendor/github.com/pelletier/go-toml/v2/README.md
index d53f43971..63b92f3b0 100644
--- a/vendor/github.com/pelletier/go-toml/v2/README.md
+++ b/vendor/github.com/pelletier/go-toml/v2/README.md
@@ -45,16 +45,15 @@ to check for typos. [See example in the documentation][strict].
 
 ### Contextualized errors
 
-When most decoding errors occur, go-toml returns [`DecodeError`][decode-err]),
+When most decoding errors occur, go-toml returns [`DecodeError`][decode-err],
 which contains a human readable contextualized version of the error. For
 example:
 
 ```
-2| key1 = "value1"
-3| key2 = "missing2"
- | ~~~~ missing field
-4| key3 = "missing3"
-5| key4 = "value4"
+1| [server]
+2| path = 100
+ |        ~~~ cannot decode TOML integer into struct field toml_test.Server.Path of type string
+3| port = 50
 ```
 
 [decode-err]: https://pkg.go.dev/github.com/pelletier/go-toml/v2#DecodeError
@@ -73,6 +72,26 @@ representation.
 [tlt]: https://pkg.go.dev/github.com/pelletier/go-toml/v2#LocalTime
 [tldt]: https://pkg.go.dev/github.com/pelletier/go-toml/v2#LocalDateTime
 
+### Commented config
+
+Since TOML is often used for configuration files, go-toml can emit documents
+annotated with [comments and commented-out values][comments-example]. For
+example, it can generate the following file:
+
+```toml
+# Host IP to connect to.
+host = '127.0.0.1'
+# Port of the remote server.
+port = 4242
+
+# Encryption parameters (optional)
+# [TLS]
+# cipher = 'AEAD-AES128-GCM-SHA256'
+# version = 'TLS 1.3'
+```
+
+[comments-example]: https://pkg.go.dev/github.com/pelletier/go-toml/v2#example-Marshal-Commented
+
 ## Getting started
 
 Given the following struct, let's see how to read it and write it as TOML:
@@ -497,27 +516,20 @@ is not necessary anymore.
 
 V1 used to provide multiple struct tags: `comment`, `commented`, `multiline`,
 `toml`, and `omitempty`. To behave more like the standard library, v2 has merged
-`toml`, `multiline`, and `omitempty`. For example:
+`toml`, `multiline`, `commented`, and `omitempty`. For example:
 
 ```go
 type doc struct {
 	// v1
-	F string `toml:"field" multiline:"true" omitempty:"true"`
+	F string `toml:"field" multiline:"true" omitempty:"true" commented:"true"`
 	// v2
-	F string `toml:"field,multiline,omitempty"`
+	F string `toml:"field,multiline,omitempty,commented"`
 }
 ```
 
 Has a result, the `Encoder.SetTag*` methods have been removed, as there is just
 one tag now.
 
-
-#### `commented` tag has been removed
-
-There is no replacement for the `commented` tag. This feature would be better
-suited in a proper document model for go-toml v2, which has been [cut from
-scope][nodoc] at the moment.
-
 #### `Encoder.ArraysWithOneElementPerLine` has been renamed
 
 The new name is `Encoder.SetArraysMultiline`. The behavior should be the same.
diff --git a/vendor/github.com/pelletier/go-toml/v2/ci.sh b/vendor/github.com/pelletier/go-toml/v2/ci.sh
index 05c76f297..9ae8b7537 100644
--- a/vendor/github.com/pelletier/go-toml/v2/ci.sh
+++ b/vendor/github.com/pelletier/go-toml/v2/ci.sh
@@ -79,6 +79,7 @@ cover() {
     go test -covermode=atomic  -coverpkg=./... -coverprofile=coverage.out.tmp ./...
     cat coverage.out.tmp | grep -v fuzz | grep -v testsuite | grep -v tomltestgen | grep -v gotoml-test-decoder > coverage.out
     go tool cover -func=coverage.out
+    echo "Coverage profile for ${branch}: ${dir}/coverage.out" >&2
     popd
 
     if [ "${branch}" != "HEAD" ]; then
diff --git a/vendor/github.com/pelletier/go-toml/v2/decode.go b/vendor/github.com/pelletier/go-toml/v2/decode.go
index 3a860d0f6..f0ec3b170 100644
--- a/vendor/github.com/pelletier/go-toml/v2/decode.go
+++ b/vendor/github.com/pelletier/go-toml/v2/decode.go
@@ -318,7 +318,7 @@ func parseFloat(b []byte) (float64, error) {
 	if cleaned[0] == '+' || cleaned[0] == '-' {
 		start = 1
 	}
-	if cleaned[start] == '0' && isDigit(cleaned[start+1]) {
+	if cleaned[start] == '0' && len(cleaned) > start+1 && isDigit(cleaned[start+1]) {
 		return 0, unstable.NewParserError(b, "float integer part cannot have leading zeroes")
 	}
 
diff --git a/vendor/github.com/pelletier/go-toml/v2/marshaler.go b/vendor/github.com/pelletier/go-toml/v2/marshaler.go
index 838752607..6fe78533c 100644
--- a/vendor/github.com/pelletier/go-toml/v2/marshaler.go
+++ b/vendor/github.com/pelletier/go-toml/v2/marshaler.go
@@ -148,6 +148,9 @@ func (enc *Encoder) SetIndentTables(indent bool) *Encoder {
 //
 // The "omitempty" option prevents empty values or groups from being emitted.
 //
+// The "commented" option prefixes the value and all its children with a comment
+// symbol.
+//
 // In addition to the "toml" tag struct tag, a "comment" tag can be used to emit
 // a TOML comment before the value being annotated. Comments are ignored inside
 // inline tables. For array tables, the comment is only present before the first
@@ -180,6 +183,7 @@ func (enc *Encoder) Encode(v interface{}) error {
 type valueOptions struct {
 	multiline bool
 	omitempty bool
+	commented bool
 	comment   string
 }
 
@@ -205,6 +209,9 @@ type encoderCtx struct {
 	// Indentation level
 	indent int
 
+	// Prefix the current value with a comment.
+	commented bool
+
 	// Options coming from struct tags
 	options valueOptions
 }
@@ -357,6 +364,7 @@ func (enc *Encoder) encodeKv(b []byte, ctx encoderCtx, options valueOptions, v r
 
 	if !ctx.inline {
 		b = enc.encodeComment(ctx.indent, options.comment, b)
+		b = enc.commented(ctx.commented, b)
 		b = enc.indent(ctx.indent, b)
 	}
 
@@ -378,6 +386,13 @@ func (enc *Encoder) encodeKv(b []byte, ctx encoderCtx, options valueOptions, v r
 	return b, nil
 }
 
+func (enc *Encoder) commented(commented bool, b []byte) []byte {
+	if commented {
+		return append(b, "# "...)
+	}
+	return b
+}
+
 func isEmptyValue(v reflect.Value) bool {
 	switch v.Kind() {
 	case reflect.Struct:
@@ -526,6 +541,8 @@ func (enc *Encoder) encodeTableHeader(ctx encoderCtx, b []byte) ([]byte, error)
 
 	b = enc.encodeComment(ctx.indent, ctx.options.comment, b)
 
+	b = enc.commented(ctx.commented, b)
+
 	b = enc.indent(ctx.indent, b)
 
 	b = append(b, '[')
@@ -704,6 +721,7 @@ func walkStruct(ctx encoderCtx, t *table, v reflect.Value) {
 		options := valueOptions{
 			multiline: opts.multiline,
 			omitempty: opts.omitempty,
+			commented: opts.commented,
 			comment:   fieldType.Tag.Get("comment"),
 		}
 
@@ -763,6 +781,7 @@ type tagOptions struct {
 	multiline bool
 	inline    bool
 	omitempty bool
+	commented bool
 }
 
 func parseTag(tag string) (string, tagOptions) {
@@ -790,6 +809,8 @@ func parseTag(tag string) (string, tagOptions) {
 			opts.inline = true
 		case "omitempty":
 			opts.omitempty = true
+		case "commented":
+			opts.commented = true
 		}
 	}
 
@@ -825,8 +846,10 @@ func (enc *Encoder) encodeTable(b []byte, ctx encoderCtx, t table) ([]byte, erro
 		hasNonEmptyKV = true
 
 		ctx.setKey(kv.Key)
+		ctx2 := ctx
+		ctx2.commented = kv.Options.commented || ctx2.commented
 
-		b, err = enc.encodeKv(b, ctx, kv.Options, kv.Value)
+		b, err = enc.encodeKv(b, ctx2, kv.Options, kv.Value)
 		if err != nil {
 			return nil, err
 		}
@@ -851,8 +874,10 @@ func (enc *Encoder) encodeTable(b []byte, ctx encoderCtx, t table) ([]byte, erro
 		ctx.setKey(table.Key)
 
 		ctx.options = table.Options
+		ctx2 := ctx
+		ctx2.commented = ctx2.commented || ctx.options.commented
 
-		b, err = enc.encode(b, ctx, table.Value)
+		b, err = enc.encode(b, ctx2, table.Value)
 		if err != nil {
 			return nil, err
 		}
@@ -970,6 +995,9 @@ func (enc *Encoder) encodeSliceAsArrayTable(b []byte, ctx encoderCtx, v reflect.
 	ctx.shiftKey()
 
 	scratch := make([]byte, 0, 64)
+
+	scratch = enc.commented(ctx.commented, scratch)
+
 	scratch = append(scratch, "[["...)
 
 	for i, k := range ctx.parentKey {
@@ -985,6 +1013,10 @@ func (enc *Encoder) encodeSliceAsArrayTable(b []byte, ctx encoderCtx, v reflect.
 
 	b = enc.encodeComment(ctx.indent, ctx.options.comment, b)
 
+	if enc.indentTables {
+		ctx.indent++
+	}
+
 	for i := 0; i < v.Len(); i++ {
 		if i != 0 {
 			b = append(b, "\n"...)
diff --git a/vendor/github.com/pelletier/go-toml/v2/unmarshaler.go b/vendor/github.com/pelletier/go-toml/v2/unmarshaler.go
index e9c9a7e84..868c74c15 100644
--- a/vendor/github.com/pelletier/go-toml/v2/unmarshaler.go
+++ b/vendor/github.com/pelletier/go-toml/v2/unmarshaler.go
@@ -149,12 +149,16 @@ type errorContext struct {
 }
 
 func (d *decoder) typeMismatchError(toml string, target reflect.Type) error {
+	return fmt.Errorf("toml: %s", d.typeMismatchString(toml, target))
+}
+
+func (d *decoder) typeMismatchString(toml string, target reflect.Type) string {
 	if d.errorContext != nil && d.errorContext.Struct != nil {
 		ctx := d.errorContext
 		f := ctx.Struct.FieldByIndex(ctx.Field)
-		return fmt.Errorf("toml: cannot decode TOML %s into struct field %s.%s of type %s", toml, ctx.Struct, f.Name, f.Type)
+		return fmt.Sprintf("cannot decode TOML %s into struct field %s.%s of type %s", toml, ctx.Struct, f.Name, f.Type)
 	}
-	return fmt.Errorf("toml: cannot decode TOML %s into a Go value of type %s", toml, target)
+	return fmt.Sprintf("cannot decode TOML %s into a Go value of type %s", toml, target)
 }
 
 func (d *decoder) expr() *unstable.Node {
@@ -491,11 +495,6 @@ func (d *decoder) handleKeyPart(key unstable.Iterator, v reflect.Value, nextFn h
 		if err != nil || d.skipUntilTable {
 			return reflect.Value{}, err
 		}
-		// if !x.IsValid() && f.Type().Kind() == reflect.Ptr {
-		// 	fmt.Println(x)
-		// 	fmt.Println(f.Type())
-		// 	x = reflect.New(f.Type().Elem())
-		// }
 		if x.IsValid() {
 			f.Set(x)
 		}
@@ -968,7 +967,7 @@ func (d *decoder) unmarshalInteger(value *unstable.Node, v reflect.Value) error
 	case reflect.Interface:
 		r = reflect.ValueOf(i)
 	default:
-		return d.typeMismatchError("integer", v.Type())
+		return unstable.NewParserError(d.p.Raw(value.Raw), d.typeMismatchString("integer", v.Type()))
 	}
 
 	if !r.Type().AssignableTo(v.Type()) {
@@ -987,7 +986,7 @@ func (d *decoder) unmarshalString(value *unstable.Node, v reflect.Value) error {
 	case reflect.Interface:
 		v.Set(reflect.ValueOf(string(value.Data)))
 	default:
-		return unstable.NewParserError(d.p.Raw(value.Raw), "cannot store TOML string into a Go %s", v.Kind())
+		return unstable.NewParserError(d.p.Raw(value.Raw), d.typeMismatchString("string", v.Type()))
 	}
 
 	return nil
diff --git a/vendor/github.com/pelletier/go-toml/v2/unstable/parser.go b/vendor/github.com/pelletier/go-toml/v2/unstable/parser.go
index a8eb05294..50358a44f 100644
--- a/vendor/github.com/pelletier/go-toml/v2/unstable/parser.go
+++ b/vendor/github.com/pelletier/go-toml/v2/unstable/parser.go
@@ -1013,6 +1013,7 @@ func (p *Parser) parseIntOrFloatOrDateTime(b []byte) (reference, []byte, error)
 		return p.builder.Push(Node{
 			Kind: Float,
 			Data: b[:3],
+			Raw:  p.Range(b[:3]),
 		}), b[3:], nil
 	case 'n':
 		if !scanFollowsNan(b) {
@@ -1022,6 +1023,7 @@ func (p *Parser) parseIntOrFloatOrDateTime(b []byte) (reference, []byte, error)
 		return p.builder.Push(Node{
 			Kind: Float,
 			Data: b[:3],
+			Raw:  p.Range(b[:3]),
 		}), b[3:], nil
 	case '+', '-':
 		return p.scanIntOrFloat(b)
@@ -1146,6 +1148,7 @@ func (p *Parser) scanIntOrFloat(b []byte) (reference, []byte, error) {
 		return p.builder.Push(Node{
 			Kind: Integer,
 			Data: b[:i],
+			Raw:  p.Range(b[:i]),
 		}), b[i:], nil
 	}
 
@@ -1169,6 +1172,7 @@ func (p *Parser) scanIntOrFloat(b []byte) (reference, []byte, error) {
 				return p.builder.Push(Node{
 					Kind: Float,
 					Data: b[:i+3],
+					Raw:  p.Range(b[:i+3]),
 				}), b[i+3:], nil
 			}
 
@@ -1180,6 +1184,7 @@ func (p *Parser) scanIntOrFloat(b []byte) (reference, []byte, error) {
 				return p.builder.Push(Node{
 					Kind: Float,
 					Data: b[:i+3],
+					Raw:  p.Range(b[:i+3]),
 				}), b[i+3:], nil
 			}
 
@@ -1202,6 +1207,7 @@ func (p *Parser) scanIntOrFloat(b []byte) (reference, []byte, error) {
 	return p.builder.Push(Node{
 		Kind: kind,
 		Data: b[:i],
+		Raw:  p.Range(b[:i]),
 	}), b[i:], nil
 }
 
diff --git a/vendor/github.com/sosodev/duration/.gitignore b/vendor/github.com/sosodev/duration/.gitignore
new file mode 100644
index 000000000..485dee64b
--- /dev/null
+++ b/vendor/github.com/sosodev/duration/.gitignore
@@ -0,0 +1 @@
+.idea
diff --git a/vendor/github.com/sosodev/duration/LICENSE b/vendor/github.com/sosodev/duration/LICENSE
new file mode 100644
index 000000000..0e660e6f4
--- /dev/null
+++ b/vendor/github.com/sosodev/duration/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2022 Kyle McGough
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/vendor/github.com/sosodev/duration/duration.go b/vendor/github.com/sosodev/duration/duration.go
new file mode 100644
index 000000000..172355351
--- /dev/null
+++ b/vendor/github.com/sosodev/duration/duration.go
@@ -0,0 +1,301 @@
+package duration
+
+import (
+	"errors"
+	"fmt"
+	"math"
+	"strconv"
+	"time"
+	"unicode"
+)
+
+// Duration holds all the smaller units that make up the duration
+type Duration struct {
+	Years    float64
+	Months   float64
+	Weeks    float64
+	Days     float64
+	Hours    float64
+	Minutes  float64
+	Seconds  float64
+	Negative bool
+}
+
+const (
+	parsingPeriod = iota
+	parsingTime
+
+	hoursPerDay   = 24
+	hoursPerWeek  = hoursPerDay * 7
+	hoursPerMonth = hoursPerYear / 12
+	hoursPerYear  = hoursPerDay * 365
+
+	nsPerSecond = 1000000000
+	nsPerMinute = nsPerSecond * 60
+	nsPerHour   = nsPerMinute * 60
+	nsPerDay    = nsPerHour * hoursPerDay
+	nsPerWeek   = nsPerHour * hoursPerWeek
+	nsPerMonth  = nsPerHour * hoursPerMonth
+	nsPerYear   = nsPerHour * hoursPerYear
+)
+
+var (
+	// ErrUnexpectedInput is returned when an input in the duration string does not match expectations
+	ErrUnexpectedInput = errors.New("unexpected input")
+)
+
+// Parse attempts to parse the given duration string into a *Duration,
+// if parsing fails an error is returned instead
+func Parse(d string) (*Duration, error) {
+	state := parsingPeriod
+	duration := &Duration{}
+	num := ""
+	var err error
+
+	for _, char := range d {
+		switch char {
+		case '-':
+			duration.Negative = true
+		case 'P':
+			state = parsingPeriod
+		case 'T':
+			state = parsingTime
+		case 'Y':
+			if state != parsingPeriod {
+				return nil, ErrUnexpectedInput
+			}
+
+			duration.Years, err = strconv.ParseFloat(num, 64)
+			if err != nil {
+				return nil, err
+			}
+			num = ""
+		case 'M':
+			if state == parsingPeriod {
+				duration.Months, err = strconv.ParseFloat(num, 64)
+				if err != nil {
+					return nil, err
+				}
+				num = ""
+			} else if state == parsingTime {
+				duration.Minutes, err = strconv.ParseFloat(num, 64)
+				if err != nil {
+					return nil, err
+				}
+				num = ""
+			}
+		case 'W':
+			if state != parsingPeriod {
+				return nil, ErrUnexpectedInput
+			}
+
+			duration.Weeks, err = strconv.ParseFloat(num, 64)
+			if err != nil {
+				return nil, err
+			}
+			num = ""
+		case 'D':
+			if state != parsingPeriod {
+				return nil, ErrUnexpectedInput
+			}
+
+			duration.Days, err = strconv.ParseFloat(num, 64)
+			if err != nil {
+				return nil, err
+			}
+			num = ""
+		case 'H':
+			if state != parsingTime {
+				return nil, ErrUnexpectedInput
+			}
+
+			duration.Hours, err = strconv.ParseFloat(num, 64)
+			if err != nil {
+				return nil, err
+			}
+			num = ""
+		case 'S':
+			if state != parsingTime {
+				return nil, ErrUnexpectedInput
+			}
+
+			duration.Seconds, err = strconv.ParseFloat(num, 64)
+			if err != nil {
+				return nil, err
+			}
+			num = ""
+		default:
+			if unicode.IsNumber(char) || char == '.' {
+				num += string(char)
+				continue
+			}
+
+			return nil, ErrUnexpectedInput
+		}
+	}
+
+	return duration, nil
+}
+
+// FromTimeDuration converts the given time.Duration into duration.Duration.
+// Note that for *Duration's with period values of a month or year that the duration becomes a bit fuzzy
+// since obviously those things vary month to month and year to year
+func FromTimeDuration(d time.Duration) *Duration {
+	duration := &Duration{}
+	if d == 0 {
+		return duration
+	}
+
+	if d < 0 {
+		d = -d
+		duration.Negative = true
+	}
+
+	if d.Hours() >= hoursPerYear {
+		duration.Years = math.Floor(d.Hours() / hoursPerYear)
+		d -= time.Duration(duration.Years) * nsPerYear
+	}
+	if d.Hours() >= hoursPerMonth {
+		duration.Months = math.Floor(d.Hours() / hoursPerMonth)
+		d -= time.Duration(duration.Months) * nsPerMonth
+	}
+	if d.Hours() >= hoursPerWeek {
+		duration.Weeks = math.Floor(d.Hours() / hoursPerWeek)
+		d -= time.Duration(duration.Weeks) * nsPerWeek
+	}
+	if d.Hours() >= hoursPerDay {
+		duration.Days = math.Floor(d.Hours() / hoursPerDay)
+		d -= time.Duration(duration.Days) * nsPerDay
+	}
+	if d.Hours() >= 1 {
+		duration.Hours = math.Floor(d.Hours())
+		d -= time.Duration(duration.Hours) * nsPerHour
+	}
+	if d.Minutes() >= 1 {
+		duration.Minutes = math.Floor(d.Minutes())
+		d -= time.Duration(duration.Minutes) * nsPerMinute
+	}
+	duration.Seconds = d.Seconds()
+
+	return duration
+}
+
+// Format formats the given time.Duration into an ISO 8601 duration string (e.g. P1DT6H5M),
+// negative durations are prefixed with a minus sign, for a zero duration "PT0S" is returned.
+// Note that for *Duration's with period values of a month or year that the duration becomes a bit fuzzy
+// since obviously those things vary month to month and year to year
+func Format(d time.Duration) string {
+	return FromTimeDuration(d).String()
+}
+
+// ToTimeDuration converts the *Duration to the standard library's time.Duration.
+// Note that for *Duration's with period values of a month or year that the duration becomes a bit fuzzy
+// since obviously those things vary month to month and year to year
+func (duration *Duration) ToTimeDuration() time.Duration {
+	var timeDuration time.Duration
+
+	// zero checks are here to avoid unnecessary math operations, on a durations such as `PT5M`
+	if duration.Years != 0 {
+		timeDuration += time.Duration(math.Round(duration.Years * nsPerYear))
+	}
+	if duration.Months != 0 {
+		timeDuration += time.Duration(math.Round(duration.Months * nsPerMonth))
+	}
+	if duration.Weeks != 0 {
+		timeDuration += time.Duration(math.Round(duration.Weeks * nsPerWeek))
+	}
+	if duration.Days != 0 {
+		timeDuration += time.Duration(math.Round(duration.Days * nsPerDay))
+	}
+	if duration.Hours != 0 {
+		timeDuration += time.Duration(math.Round(duration.Hours * nsPerHour))
+	}
+	if duration.Minutes != 0 {
+		timeDuration += time.Duration(math.Round(duration.Minutes * nsPerMinute))
+	}
+	if duration.Seconds != 0 {
+		timeDuration += time.Duration(math.Round(duration.Seconds * nsPerSecond))
+	}
+	if duration.Negative {
+		timeDuration = -timeDuration
+	}
+
+	return timeDuration
+}
+
+// String returns the ISO8601 duration string for the *Duration
+func (duration *Duration) String() string {
+	d := "P"
+	hasTime := false
+
+	appendD := func(designator string, value float64, isTime bool) {
+		if !hasTime && isTime {
+			d += "T"
+			hasTime = true
+		}
+
+		d += strconv.FormatFloat(value, 'f', -1, 64) + designator
+	}
+
+	if duration.Years != 0 {
+		appendD("Y", duration.Years, false)
+	}
+
+	if duration.Months != 0 {
+		appendD("M", duration.Months, false)
+	}
+
+	if duration.Weeks != 0 {
+		appendD("W", duration.Weeks, false)
+	}
+
+	if duration.Days != 0 {
+		appendD("D", duration.Days, false)
+	}
+
+	if duration.Hours != 0 {
+		appendD("H", duration.Hours, true)
+	}
+
+	if duration.Minutes != 0 {
+		appendD("M", duration.Minutes, true)
+	}
+
+	if duration.Seconds != 0 {
+		appendD("S", duration.Seconds, true)
+	}
+
+	// if the duration is zero, return "PT0S"
+	if d == "P" {
+		d += "T0S"
+	}
+
+	if duration.Negative {
+		return "-" + d
+	}
+
+	return d
+}
+
+func (duration Duration) MarshalJSON() ([]byte, error) {
+	return []byte("\"" + duration.String() + "\""), nil
+}
+
+func (duration *Duration) UnmarshalJSON(source []byte) error {
+	strVal := string(source)
+	if len(strVal) < 2 {
+		return fmt.Errorf("invalid ISO 8601 duration: %s", strVal)
+	}
+	strVal = strVal[1 : len(strVal)-1]
+
+	if strVal == "null" {
+		return nil
+	}
+
+	parsed, err := Parse(strVal)
+	if err != nil {
+		return fmt.Errorf("invalid ISO 8601 duration: %s", strVal)
+	}
+	*duration = *parsed
+	return nil
+}
diff --git a/vendor/github.com/sosodev/duration/readme.md b/vendor/github.com/sosodev/duration/readme.md
new file mode 100644
index 000000000..ec987dc5f
--- /dev/null
+++ b/vendor/github.com/sosodev/duration/readme.md
@@ -0,0 +1,54 @@
+# duration
+
+[![Go Reference](https://pkg.go.dev/badge/github.com/sosodev/duration.svg)](https://pkg.go.dev/github.com/sosodev/duration)
+
+It's a Go module for parsing [ISO 8601 durations](https://en.wikipedia.org/wiki/ISO_8601#Durations) and converting them to the often much more useful `time.Duration`.
+
+## why?
+
+ISO 8601 is a pretty common standard and sometimes these durations show up in the wild.
+
+## installation
+
+`go get github.com/sosodev/duration`
+
+## [usage](https://go.dev/play/p/Nz5akjy1c6W)
+
+```go
+package main
+
+import (
+	"fmt"
+	"time"
+	"github.com/sosodev/duration"
+)
+
+func main() {
+	d, err := duration.Parse("P3Y6M4DT12H30M5.5S")
+	if err != nil {
+		panic(err)
+	}
+	
+	fmt.Println(d.Years) // 3
+	fmt.Println(d.Months) // 6
+	fmt.Println(d.Days) // 4
+	fmt.Println(d.Hours) // 12
+	fmt.Println(d.Minutes) // 30
+	fmt.Println(d.Seconds) // 5.5
+	
+	d, err = duration.Parse("T33.3S")
+	if err != nil {
+		panic(err)
+	}
+	
+	fmt.Println(d.ToTimeDuration() == time.Second*33+time.Millisecond*300) // true
+}
+```
+
+## correctness
+
+This module aims to implement the ISO 8601 duration specification correctly. It properly supports fractional units and has unit tests
+that assert the correctness of it's parsing and conversion to a `time.Duration`.
+
+With that said durations with months or years specified will be converted to `time.Duration` with a little fuzziness. Since I
+couldn't find a standard value, and they obviously vary, for those I used `2.628e+15` nanoseconds for a month and `3.154e+16` nanoseconds for a year.
diff --git a/vendor/golang.org/x/crypto/chacha20/chacha_arm64.go b/vendor/golang.org/x/crypto/chacha20/chacha_arm64.go
index 94c71ac1a..5dfacbb98 100644
--- a/vendor/golang.org/x/crypto/chacha20/chacha_arm64.go
+++ b/vendor/golang.org/x/crypto/chacha20/chacha_arm64.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build go1.11 && gc && !purego
-// +build go1.11,gc,!purego
+//go:build gc && !purego
+// +build gc,!purego
 
 package chacha20
 
diff --git a/vendor/golang.org/x/crypto/chacha20/chacha_arm64.s b/vendor/golang.org/x/crypto/chacha20/chacha_arm64.s
index 63cae9e6f..f1f66230d 100644
--- a/vendor/golang.org/x/crypto/chacha20/chacha_arm64.s
+++ b/vendor/golang.org/x/crypto/chacha20/chacha_arm64.s
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build go1.11 && gc && !purego
-// +build go1.11,gc,!purego
+//go:build gc && !purego
+// +build gc,!purego
 
 #include "textflag.h"
 
diff --git a/vendor/golang.org/x/crypto/chacha20/chacha_noasm.go b/vendor/golang.org/x/crypto/chacha20/chacha_noasm.go
index 025b49897..02ff3d05e 100644
--- a/vendor/golang.org/x/crypto/chacha20/chacha_noasm.go
+++ b/vendor/golang.org/x/crypto/chacha20/chacha_noasm.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build (!arm64 && !s390x && !ppc64le) || (arm64 && !go1.11) || !gc || purego
-// +build !arm64,!s390x,!ppc64le arm64,!go1.11 !gc purego
+//go:build (!arm64 && !s390x && !ppc64le) || !gc || purego
+// +build !arm64,!s390x,!ppc64le !gc purego
 
 package chacha20
 
diff --git a/vendor/golang.org/x/crypto/cryptobyte/builder.go b/vendor/golang.org/x/crypto/cryptobyte/builder.go
index c05ac7d16..cf254f5f1 100644
--- a/vendor/golang.org/x/crypto/cryptobyte/builder.go
+++ b/vendor/golang.org/x/crypto/cryptobyte/builder.go
@@ -95,6 +95,11 @@ func (b *Builder) AddUint32(v uint32) {
 	b.add(byte(v>>24), byte(v>>16), byte(v>>8), byte(v))
 }
 
+// AddUint48 appends a big-endian, 48-bit value to the byte string.
+func (b *Builder) AddUint48(v uint64) {
+	b.add(byte(v>>40), byte(v>>32), byte(v>>24), byte(v>>16), byte(v>>8), byte(v))
+}
+
 // AddUint64 appends a big-endian, 64-bit value to the byte string.
 func (b *Builder) AddUint64(v uint64) {
 	b.add(byte(v>>56), byte(v>>48), byte(v>>40), byte(v>>32), byte(v>>24), byte(v>>16), byte(v>>8), byte(v))
diff --git a/vendor/golang.org/x/crypto/cryptobyte/string.go b/vendor/golang.org/x/crypto/cryptobyte/string.go
index 0531a3d6f..10692a8a3 100644
--- a/vendor/golang.org/x/crypto/cryptobyte/string.go
+++ b/vendor/golang.org/x/crypto/cryptobyte/string.go
@@ -81,6 +81,17 @@ func (s *String) ReadUint32(out *uint32) bool {
 	return true
 }
 
+// ReadUint48 decodes a big-endian, 48-bit value into out and advances over it.
+// It reports whether the read was successful.
+func (s *String) ReadUint48(out *uint64) bool {
+	v := s.read(6)
+	if v == nil {
+		return false
+	}
+	*out = uint64(v[0])<<40 | uint64(v[1])<<32 | uint64(v[2])<<24 | uint64(v[3])<<16 | uint64(v[4])<<8 | uint64(v[5])
+	return true
+}
+
 // ReadUint64 decodes a big-endian, 64-bit value into out and advances over it.
 // It reports whether the read was successful.
 func (s *String) ReadUint64(out *uint64) bool {
diff --git a/vendor/golang.org/x/crypto/ed25519/ed25519.go b/vendor/golang.org/x/crypto/ed25519/ed25519.go
deleted file mode 100644
index a7828345f..000000000
--- a/vendor/golang.org/x/crypto/ed25519/ed25519.go
+++ /dev/null
@@ -1,71 +0,0 @@
-// Copyright 2019 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Package ed25519 implements the Ed25519 signature algorithm. See
-// https://ed25519.cr.yp.to/.
-//
-// These functions are also compatible with the “Ed25519” function defined in
-// RFC 8032. However, unlike RFC 8032's formulation, this package's private key
-// representation includes a public key suffix to make multiple signing
-// operations with the same key more efficient. This package refers to the RFC
-// 8032 private key as the “seed”.
-//
-// Beginning with Go 1.13, the functionality of this package was moved to the
-// standard library as crypto/ed25519. This package only acts as a compatibility
-// wrapper.
-package ed25519
-
-import (
-	"crypto/ed25519"
-	"io"
-)
-
-const (
-	// PublicKeySize is the size, in bytes, of public keys as used in this package.
-	PublicKeySize = 32
-	// PrivateKeySize is the size, in bytes, of private keys as used in this package.
-	PrivateKeySize = 64
-	// SignatureSize is the size, in bytes, of signatures generated and verified by this package.
-	SignatureSize = 64
-	// SeedSize is the size, in bytes, of private key seeds. These are the private key representations used by RFC 8032.
-	SeedSize = 32
-)
-
-// PublicKey is the type of Ed25519 public keys.
-//
-// This type is an alias for crypto/ed25519's PublicKey type.
-// See the crypto/ed25519 package for the methods on this type.
-type PublicKey = ed25519.PublicKey
-
-// PrivateKey is the type of Ed25519 private keys. It implements crypto.Signer.
-//
-// This type is an alias for crypto/ed25519's PrivateKey type.
-// See the crypto/ed25519 package for the methods on this type.
-type PrivateKey = ed25519.PrivateKey
-
-// GenerateKey generates a public/private key pair using entropy from rand.
-// If rand is nil, crypto/rand.Reader will be used.
-func GenerateKey(rand io.Reader) (PublicKey, PrivateKey, error) {
-	return ed25519.GenerateKey(rand)
-}
-
-// NewKeyFromSeed calculates a private key from a seed. It will panic if
-// len(seed) is not SeedSize. This function is provided for interoperability
-// with RFC 8032. RFC 8032's private keys correspond to seeds in this
-// package.
-func NewKeyFromSeed(seed []byte) PrivateKey {
-	return ed25519.NewKeyFromSeed(seed)
-}
-
-// Sign signs the message with privateKey and returns a signature. It will
-// panic if len(privateKey) is not PrivateKeySize.
-func Sign(privateKey PrivateKey, message []byte) []byte {
-	return ed25519.Sign(privateKey, message)
-}
-
-// Verify reports whether sig is a valid signature of message by publicKey. It
-// will panic if len(publicKey) is not PublicKeySize.
-func Verify(publicKey PublicKey, message, sig []byte) bool {
-	return ed25519.Verify(publicKey, message, sig)
-}
diff --git a/vendor/golang.org/x/crypto/sha3/sha3.go b/vendor/golang.org/x/crypto/sha3/sha3.go
index fa182beb4..4884d172a 100644
--- a/vendor/golang.org/x/crypto/sha3/sha3.go
+++ b/vendor/golang.org/x/crypto/sha3/sha3.go
@@ -121,11 +121,11 @@ func (d *state) padAndPermute(dsbyte byte) {
 	copyOut(d, d.buf)
 }
 
-// Write absorbs more data into the hash's state. It produces an error
-// if more data is written to the ShakeHash after writing
+// Write absorbs more data into the hash's state. It panics if any
+// output has already been read.
 func (d *state) Write(p []byte) (written int, err error) {
 	if d.state != spongeAbsorbing {
-		panic("sha3: write to sponge after read")
+		panic("sha3: Write after Read")
 	}
 	if d.buf == nil {
 		d.buf = d.storage.asBytes()[:0]
@@ -182,12 +182,16 @@ func (d *state) Read(out []byte) (n int, err error) {
 }
 
 // Sum applies padding to the hash state and then squeezes out the desired
-// number of output bytes.
+// number of output bytes. It panics if any output has already been read.
 func (d *state) Sum(in []byte) []byte {
+	if d.state != spongeAbsorbing {
+		panic("sha3: Sum after Read")
+	}
+
 	// Make a copy of the original hash so that caller can keep writing
 	// and summing.
 	dup := d.clone()
-	hash := make([]byte, dup.outputLen)
+	hash := make([]byte, dup.outputLen, 64) // explicit cap to allow stack allocation
 	dup.Read(hash)
 	return append(in, hash...)
 }
diff --git a/vendor/golang.org/x/crypto/sha3/sha3_s390x.go b/vendor/golang.org/x/crypto/sha3/sha3_s390x.go
index 63a3edb4c..ec26f147f 100644
--- a/vendor/golang.org/x/crypto/sha3/sha3_s390x.go
+++ b/vendor/golang.org/x/crypto/sha3/sha3_s390x.go
@@ -49,7 +49,7 @@ type asmState struct {
 	buf       []byte          // care must be taken to ensure cap(buf) is a multiple of rate
 	rate      int             // equivalent to block size
 	storage   [3072]byte      // underlying storage for buf
-	outputLen int             // output length if fixed, 0 if not
+	outputLen int             // output length for full security
 	function  code            // KIMD/KLMD function code
 	state     spongeDirection // whether the sponge is absorbing or squeezing
 }
@@ -72,8 +72,10 @@ func newAsmState(function code) *asmState {
 		s.outputLen = 64
 	case shake_128:
 		s.rate = 168
+		s.outputLen = 32
 	case shake_256:
 		s.rate = 136
+		s.outputLen = 64
 	default:
 		panic("sha3: unrecognized function code")
 	}
@@ -108,7 +110,7 @@ func (s *asmState) resetBuf() {
 // It never returns an error.
 func (s *asmState) Write(b []byte) (int, error) {
 	if s.state != spongeAbsorbing {
-		panic("sha3: write to sponge after read")
+		panic("sha3: Write after Read")
 	}
 	length := len(b)
 	for len(b) > 0 {
@@ -192,8 +194,8 @@ func (s *asmState) Read(out []byte) (n int, err error) {
 // Sum appends the current hash to b and returns the resulting slice.
 // It does not change the underlying hash state.
 func (s *asmState) Sum(b []byte) []byte {
-	if s.outputLen == 0 {
-		panic("sha3: cannot call Sum on SHAKE functions")
+	if s.state != spongeAbsorbing {
+		panic("sha3: Sum after Read")
 	}
 
 	// Copy the state to preserve the original.
diff --git a/vendor/golang.org/x/crypto/sha3/shake.go b/vendor/golang.org/x/crypto/sha3/shake.go
index d7be2954a..bb6998402 100644
--- a/vendor/golang.org/x/crypto/sha3/shake.go
+++ b/vendor/golang.org/x/crypto/sha3/shake.go
@@ -17,26 +17,25 @@ package sha3
 
 import (
 	"encoding/binary"
+	"hash"
 	"io"
 )
 
-// ShakeHash defines the interface to hash functions that
-// support arbitrary-length output.
+// ShakeHash defines the interface to hash functions that support
+// arbitrary-length output. When used as a plain [hash.Hash], it
+// produces minimum-length outputs that provide full-strength generic
+// security.
 type ShakeHash interface {
-	// Write absorbs more data into the hash's state. It panics if input is
-	// written to it after output has been read from it.
-	io.Writer
+	hash.Hash
 
 	// Read reads more output from the hash; reading affects the hash's
 	// state. (ShakeHash.Read is thus very different from Hash.Sum)
-	// It never returns an error.
+	// It never returns an error, but subsequent calls to Write or Sum
+	// will panic.
 	io.Reader
 
 	// Clone returns a copy of the ShakeHash in its current state.
 	Clone() ShakeHash
-
-	// Reset resets the ShakeHash to its initial state.
-	Reset()
 }
 
 // cSHAKE specific context
@@ -81,8 +80,8 @@ func leftEncode(value uint64) []byte {
 	return b[i-1:]
 }
 
-func newCShake(N, S []byte, rate int, dsbyte byte) ShakeHash {
-	c := cshakeState{state: &state{rate: rate, dsbyte: dsbyte}}
+func newCShake(N, S []byte, rate, outputLen int, dsbyte byte) ShakeHash {
+	c := cshakeState{state: &state{rate: rate, outputLen: outputLen, dsbyte: dsbyte}}
 
 	// leftEncode returns max 9 bytes
 	c.initBlock = make([]byte, 0, 9*2+len(N)+len(S))
@@ -119,7 +118,7 @@ func NewShake128() ShakeHash {
 	if h := newShake128Asm(); h != nil {
 		return h
 	}
-	return &state{rate: rate128, dsbyte: dsbyteShake}
+	return &state{rate: rate128, outputLen: 32, dsbyte: dsbyteShake}
 }
 
 // NewShake256 creates a new SHAKE256 variable-output-length ShakeHash.
@@ -129,7 +128,7 @@ func NewShake256() ShakeHash {
 	if h := newShake256Asm(); h != nil {
 		return h
 	}
-	return &state{rate: rate256, dsbyte: dsbyteShake}
+	return &state{rate: rate256, outputLen: 64, dsbyte: dsbyteShake}
 }
 
 // NewCShake128 creates a new instance of cSHAKE128 variable-output-length ShakeHash,
@@ -142,7 +141,7 @@ func NewCShake128(N, S []byte) ShakeHash {
 	if len(N) == 0 && len(S) == 0 {
 		return NewShake128()
 	}
-	return newCShake(N, S, rate128, dsbyteCShake)
+	return newCShake(N, S, rate128, 32, dsbyteCShake)
 }
 
 // NewCShake256 creates a new instance of cSHAKE256 variable-output-length ShakeHash,
@@ -155,7 +154,7 @@ func NewCShake256(N, S []byte) ShakeHash {
 	if len(N) == 0 && len(S) == 0 {
 		return NewShake256()
 	}
-	return newCShake(N, S, rate256, dsbyteCShake)
+	return newCShake(N, S, rate256, 64, dsbyteCShake)
 }
 
 // ShakeSum128 writes an arbitrary-length digest of data into hash.
diff --git a/vendor/golang.org/x/crypto/ssh/agent/client.go b/vendor/golang.org/x/crypto/ssh/agent/client.go
index c3e112a93..9f09aae7d 100644
--- a/vendor/golang.org/x/crypto/ssh/agent/client.go
+++ b/vendor/golang.org/x/crypto/ssh/agent/client.go
@@ -16,6 +16,7 @@ import (
 	"bytes"
 	"crypto/dsa"
 	"crypto/ecdsa"
+	"crypto/ed25519"
 	"crypto/elliptic"
 	"crypto/rsa"
 	"encoding/base64"
@@ -26,7 +27,6 @@ import (
 	"math/big"
 	"sync"
 
-	"golang.org/x/crypto/ed25519"
 	"golang.org/x/crypto/ssh"
 )
 
diff --git a/vendor/golang.org/x/crypto/ssh/agent/server.go b/vendor/golang.org/x/crypto/ssh/agent/server.go
index 9a769de03..dd2e0a3e7 100644
--- a/vendor/golang.org/x/crypto/ssh/agent/server.go
+++ b/vendor/golang.org/x/crypto/ssh/agent/server.go
@@ -7,6 +7,7 @@ package agent
 import (
 	"crypto/dsa"
 	"crypto/ecdsa"
+	"crypto/ed25519"
 	"crypto/elliptic"
 	"crypto/rsa"
 	"encoding/binary"
@@ -16,7 +17,6 @@ import (
 	"log"
 	"math/big"
 
-	"golang.org/x/crypto/ed25519"
 	"golang.org/x/crypto/ssh"
 )
 
diff --git a/vendor/golang.org/x/crypto/ssh/certs.go b/vendor/golang.org/x/crypto/ssh/certs.go
index fc04d03e1..27d0e14aa 100644
--- a/vendor/golang.org/x/crypto/ssh/certs.go
+++ b/vendor/golang.org/x/crypto/ssh/certs.go
@@ -16,8 +16,9 @@ import (
 
 // Certificate algorithm names from [PROTOCOL.certkeys]. These values can appear
 // in Certificate.Type, PublicKey.Type, and ClientConfig.HostKeyAlgorithms.
-// Unlike key algorithm names, these are not passed to AlgorithmSigner and don't
-// appear in the Signature.Format field.
+// Unlike key algorithm names, these are not passed to AlgorithmSigner nor
+// returned by MultiAlgorithmSigner and don't appear in the Signature.Format
+// field.
 const (
 	CertAlgoRSAv01        = "ssh-rsa-cert-v01@openssh.com"
 	CertAlgoDSAv01        = "ssh-dss-cert-v01@openssh.com"
@@ -255,10 +256,17 @@ func NewCertSigner(cert *Certificate, signer Signer) (Signer, error) {
 		return nil, errors.New("ssh: signer and cert have different public key")
 	}
 
-	if algorithmSigner, ok := signer.(AlgorithmSigner); ok {
+	switch s := signer.(type) {
+	case MultiAlgorithmSigner:
+		return &multiAlgorithmSigner{
+			AlgorithmSigner: &algorithmOpenSSHCertSigner{
+				&openSSHCertSigner{cert, signer}, s},
+			supportedAlgorithms: s.Algorithms(),
+		}, nil
+	case AlgorithmSigner:
 		return &algorithmOpenSSHCertSigner{
-			&openSSHCertSigner{cert, signer}, algorithmSigner}, nil
-	} else {
+			&openSSHCertSigner{cert, signer}, s}, nil
+	default:
 		return &openSSHCertSigner{cert, signer}, nil
 	}
 }
@@ -432,7 +440,9 @@ func (c *CertChecker) CheckCert(principal string, cert *Certificate) error {
 }
 
 // SignCert signs the certificate with an authority, setting the Nonce,
-// SignatureKey, and Signature fields.
+// SignatureKey, and Signature fields. If the authority implements the
+// MultiAlgorithmSigner interface the first algorithm in the list is used. This
+// is useful if you want to sign with a specific algorithm.
 func (c *Certificate) SignCert(rand io.Reader, authority Signer) error {
 	c.Nonce = make([]byte, 32)
 	if _, err := io.ReadFull(rand, c.Nonce); err != nil {
@@ -440,8 +450,20 @@ func (c *Certificate) SignCert(rand io.Reader, authority Signer) error {
 	}
 	c.SignatureKey = authority.PublicKey()
 
-	// Default to KeyAlgoRSASHA512 for ssh-rsa signers.
-	if v, ok := authority.(AlgorithmSigner); ok && v.PublicKey().Type() == KeyAlgoRSA {
+	if v, ok := authority.(MultiAlgorithmSigner); ok {
+		if len(v.Algorithms()) == 0 {
+			return errors.New("the provided authority has no signature algorithm")
+		}
+		// Use the first algorithm in the list.
+		sig, err := v.SignWithAlgorithm(rand, c.bytesForSigning(), v.Algorithms()[0])
+		if err != nil {
+			return err
+		}
+		c.Signature = sig
+		return nil
+	} else if v, ok := authority.(AlgorithmSigner); ok && v.PublicKey().Type() == KeyAlgoRSA {
+		// Default to KeyAlgoRSASHA512 for ssh-rsa signers.
+		// TODO: consider using KeyAlgoRSASHA256 as default.
 		sig, err := v.SignWithAlgorithm(rand, c.bytesForSigning(), KeyAlgoRSASHA512)
 		if err != nil {
 			return err
diff --git a/vendor/golang.org/x/crypto/ssh/client_auth.go b/vendor/golang.org/x/crypto/ssh/client_auth.go
index 409b5ea1d..5c3bc2572 100644
--- a/vendor/golang.org/x/crypto/ssh/client_auth.go
+++ b/vendor/golang.org/x/crypto/ssh/client_auth.go
@@ -71,7 +71,9 @@ func (c *connection) clientAuthenticate(config *ClientConfig) error {
 	for auth := AuthMethod(new(noneAuth)); auth != nil; {
 		ok, methods, err := auth.auth(sessionID, config.User, c.transport, config.Rand, extensions)
 		if err != nil {
-			return err
+			// We return the error later if there is no other method left to
+			// try.
+			ok = authFailure
 		}
 		if ok == authSuccess {
 			// success
@@ -101,6 +103,12 @@ func (c *connection) clientAuthenticate(config *ClientConfig) error {
 				}
 			}
 		}
+
+		if auth == nil && err != nil {
+			// We have an error and there are no other authentication methods to
+			// try, so we return it.
+			return err
+		}
 	}
 	return fmt.Errorf("ssh: unable to authenticate, attempted methods %v, no supported methods remain", tried)
 }
@@ -217,21 +225,45 @@ func (cb publicKeyCallback) method() string {
 	return "publickey"
 }
 
-func pickSignatureAlgorithm(signer Signer, extensions map[string][]byte) (as AlgorithmSigner, algo string) {
+func pickSignatureAlgorithm(signer Signer, extensions map[string][]byte) (MultiAlgorithmSigner, string, error) {
+	var as MultiAlgorithmSigner
 	keyFormat := signer.PublicKey().Type()
 
-	// Like in sendKexInit, if the public key implements AlgorithmSigner we
-	// assume it supports all algorithms, otherwise only the key format one.
-	as, ok := signer.(AlgorithmSigner)
-	if !ok {
-		return algorithmSignerWrapper{signer}, keyFormat
+	// If the signer implements MultiAlgorithmSigner we use the algorithms it
+	// support, if it implements AlgorithmSigner we assume it supports all
+	// algorithms, otherwise only the key format one.
+	switch s := signer.(type) {
+	case MultiAlgorithmSigner:
+		as = s
+	case AlgorithmSigner:
+		as = &multiAlgorithmSigner{
+			AlgorithmSigner:     s,
+			supportedAlgorithms: algorithmsForKeyFormat(underlyingAlgo(keyFormat)),
+		}
+	default:
+		as = &multiAlgorithmSigner{
+			AlgorithmSigner:     algorithmSignerWrapper{signer},
+			supportedAlgorithms: []string{underlyingAlgo(keyFormat)},
+		}
+	}
+
+	getFallbackAlgo := func() (string, error) {
+		// Fallback to use if there is no "server-sig-algs" extension or a
+		// common algorithm cannot be found. We use the public key format if the
+		// MultiAlgorithmSigner supports it, otherwise we return an error.
+		if !contains(as.Algorithms(), underlyingAlgo(keyFormat)) {
+			return "", fmt.Errorf("ssh: no common public key signature algorithm, server only supports %q for key type %q, signer only supports %v",
+				underlyingAlgo(keyFormat), keyFormat, as.Algorithms())
+		}
+		return keyFormat, nil
 	}
 
 	extPayload, ok := extensions["server-sig-algs"]
 	if !ok {
-		// If there is no "server-sig-algs" extension, fall back to the key
-		// format algorithm.
-		return as, keyFormat
+		// If there is no "server-sig-algs" extension use the fallback
+		// algorithm.
+		algo, err := getFallbackAlgo()
+		return as, algo, err
 	}
 
 	// The server-sig-algs extension only carries underlying signature
@@ -245,15 +277,22 @@ func pickSignatureAlgorithm(signer Signer, extensions map[string][]byte) (as Alg
 		}
 	}
 
-	keyAlgos := algorithmsForKeyFormat(keyFormat)
+	// Filter algorithms based on those supported by MultiAlgorithmSigner.
+	var keyAlgos []string
+	for _, algo := range algorithmsForKeyFormat(keyFormat) {
+		if contains(as.Algorithms(), underlyingAlgo(algo)) {
+			keyAlgos = append(keyAlgos, algo)
+		}
+	}
+
 	algo, err := findCommon("public key signature algorithm", keyAlgos, serverAlgos)
 	if err != nil {
-		// If there is no overlap, try the key anyway with the key format
-		// algorithm, to support servers that fail to list all supported
-		// algorithms.
-		return as, keyFormat
+		// If there is no overlap, return the fallback algorithm to support
+		// servers that fail to list all supported algorithms.
+		algo, err := getFallbackAlgo()
+		return as, algo, err
 	}
-	return as, algo
+	return as, algo, nil
 }
 
 func (cb publicKeyCallback) auth(session []byte, user string, c packetConn, rand io.Reader, extensions map[string][]byte) (authResult, []string, error) {
@@ -267,10 +306,17 @@ func (cb publicKeyCallback) auth(session []byte, user string, c packetConn, rand
 		return authFailure, nil, err
 	}
 	var methods []string
+	var errSigAlgo error
 	for _, signer := range signers {
 		pub := signer.PublicKey()
-		as, algo := pickSignatureAlgorithm(signer, extensions)
-
+		as, algo, err := pickSignatureAlgorithm(signer, extensions)
+		if err != nil && errSigAlgo == nil {
+			// If we cannot negotiate a signature algorithm store the first
+			// error so we can return it to provide a more meaningful message if
+			// no other signers work.
+			errSigAlgo = err
+			continue
+		}
 		ok, err := validateKey(pub, algo, user, c)
 		if err != nil {
 			return authFailure, nil, err
@@ -317,22 +363,12 @@ func (cb publicKeyCallback) auth(session []byte, user string, c packetConn, rand
 		// contain the "publickey" method, do not attempt to authenticate with any
 		// other keys.  According to RFC 4252 Section 7, the latter can occur when
 		// additional authentication methods are required.
-		if success == authSuccess || !containsMethod(methods, cb.method()) {
+		if success == authSuccess || !contains(methods, cb.method()) {
 			return success, methods, err
 		}
 	}
 
-	return authFailure, methods, nil
-}
-
-func containsMethod(methods []string, method string) bool {
-	for _, m := range methods {
-		if m == method {
-			return true
-		}
-	}
-
-	return false
+	return authFailure, methods, errSigAlgo
 }
 
 // validateKey validates the key provided is acceptable to the server.
diff --git a/vendor/golang.org/x/crypto/ssh/doc.go b/vendor/golang.org/x/crypto/ssh/doc.go
index f6bff60dc..edbe63340 100644
--- a/vendor/golang.org/x/crypto/ssh/doc.go
+++ b/vendor/golang.org/x/crypto/ssh/doc.go
@@ -13,6 +13,7 @@ others.
 
 References:
 
+	[PROTOCOL]: https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/PROTOCOL?rev=HEAD
 	[PROTOCOL.certkeys]: http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/PROTOCOL.certkeys?rev=HEAD
 	[SSH-PARAMETERS]:    http://www.iana.org/assignments/ssh-parameters/ssh-parameters.xml#ssh-parameters-1
 
diff --git a/vendor/golang.org/x/crypto/ssh/handshake.go b/vendor/golang.org/x/crypto/ssh/handshake.go
index 07a1843e0..70a7369ff 100644
--- a/vendor/golang.org/x/crypto/ssh/handshake.go
+++ b/vendor/golang.org/x/crypto/ssh/handshake.go
@@ -461,19 +461,24 @@ func (t *handshakeTransport) sendKexInit() error {
 	isServer := len(t.hostKeys) > 0
 	if isServer {
 		for _, k := range t.hostKeys {
-			// If k is an AlgorithmSigner, presume it supports all signature algorithms
-			// associated with the key format. (Ideally AlgorithmSigner would have a
-			// method to advertise supported algorithms, but it doesn't. This means that
-			// adding support for a new algorithm is a breaking change, as we will
-			// immediately negotiate it even if existing implementations don't support
-			// it. If that ever happens, we'll have to figure something out.)
-			// If k is not an AlgorithmSigner, we can only assume it only supports the
-			// algorithms that matches the key format. (This means that Sign can't pick
-			// a different default.)
+			// If k is a MultiAlgorithmSigner, we restrict the signature
+			// algorithms. If k is a AlgorithmSigner, presume it supports all
+			// signature algorithms associated with the key format. If k is not
+			// an AlgorithmSigner, we can only assume it only supports the
+			// algorithms that matches the key format. (This means that Sign
+			// can't pick a different default).
 			keyFormat := k.PublicKey().Type()
-			if _, ok := k.(AlgorithmSigner); ok {
+
+			switch s := k.(type) {
+			case MultiAlgorithmSigner:
+				for _, algo := range algorithmsForKeyFormat(keyFormat) {
+					if contains(s.Algorithms(), underlyingAlgo(algo)) {
+						msg.ServerHostKeyAlgos = append(msg.ServerHostKeyAlgos, algo)
+					}
+				}
+			case AlgorithmSigner:
 				msg.ServerHostKeyAlgos = append(msg.ServerHostKeyAlgos, algorithmsForKeyFormat(keyFormat)...)
-			} else {
+			default:
 				msg.ServerHostKeyAlgos = append(msg.ServerHostKeyAlgos, keyFormat)
 			}
 		}
@@ -642,16 +647,20 @@ func (t *handshakeTransport) enterKeyExchange(otherInitPacket []byte) error {
 
 	// On the server side, after the first SSH_MSG_NEWKEYS, send a SSH_MSG_EXT_INFO
 	// message with the server-sig-algs extension if the client supports it. See
-	// RFC 8308, Sections 2.4 and 3.1.
+	// RFC 8308, Sections 2.4 and 3.1, and [PROTOCOL], Section 1.9.
 	if !isClient && firstKeyExchange && contains(clientInit.KexAlgos, "ext-info-c") {
 		extInfo := &extInfoMsg{
-			NumExtensions: 1,
-			Payload:       make([]byte, 0, 4+15+4+len(supportedPubKeyAuthAlgosList)),
+			NumExtensions: 2,
+			Payload:       make([]byte, 0, 4+15+4+len(supportedPubKeyAuthAlgosList)+4+16+4+1),
 		}
 		extInfo.Payload = appendInt(extInfo.Payload, len("server-sig-algs"))
 		extInfo.Payload = append(extInfo.Payload, "server-sig-algs"...)
 		extInfo.Payload = appendInt(extInfo.Payload, len(supportedPubKeyAuthAlgosList))
 		extInfo.Payload = append(extInfo.Payload, supportedPubKeyAuthAlgosList...)
+		extInfo.Payload = appendInt(extInfo.Payload, len("ping@openssh.com"))
+		extInfo.Payload = append(extInfo.Payload, "ping@openssh.com"...)
+		extInfo.Payload = appendInt(extInfo.Payload, 1)
+		extInfo.Payload = append(extInfo.Payload, "0"...)
 		if err := t.conn.writePacket(Marshal(extInfo)); err != nil {
 			return err
 		}
@@ -685,9 +694,16 @@ func (a algorithmSignerWrapper) SignWithAlgorithm(rand io.Reader, data []byte, a
 
 func pickHostKey(hostKeys []Signer, algo string) AlgorithmSigner {
 	for _, k := range hostKeys {
+		if s, ok := k.(MultiAlgorithmSigner); ok {
+			if !contains(s.Algorithms(), underlyingAlgo(algo)) {
+				continue
+			}
+		}
+
 		if algo == k.PublicKey().Type() {
 			return algorithmSignerWrapper{k}
 		}
+
 		k, ok := k.(AlgorithmSigner)
 		if !ok {
 			continue
diff --git a/vendor/golang.org/x/crypto/ssh/keys.go b/vendor/golang.org/x/crypto/ssh/keys.go
index dac8ee724..ef1bad731 100644
--- a/vendor/golang.org/x/crypto/ssh/keys.go
+++ b/vendor/golang.org/x/crypto/ssh/keys.go
@@ -11,13 +11,16 @@ import (
 	"crypto/cipher"
 	"crypto/dsa"
 	"crypto/ecdsa"
+	"crypto/ed25519"
 	"crypto/elliptic"
 	"crypto/md5"
+	"crypto/rand"
 	"crypto/rsa"
 	"crypto/sha256"
 	"crypto/x509"
 	"encoding/asn1"
 	"encoding/base64"
+	"encoding/binary"
 	"encoding/hex"
 	"encoding/pem"
 	"errors"
@@ -26,7 +29,6 @@ import (
 	"math/big"
 	"strings"
 
-	"golang.org/x/crypto/ed25519"
 	"golang.org/x/crypto/ssh/internal/bcrypt_pbkdf"
 )
 
@@ -295,6 +297,18 @@ func MarshalAuthorizedKey(key PublicKey) []byte {
 	return b.Bytes()
 }
 
+// MarshalPrivateKey returns a PEM block with the private key serialized in the
+// OpenSSH format.
+func MarshalPrivateKey(key crypto.PrivateKey, comment string) (*pem.Block, error) {
+	return marshalOpenSSHPrivateKey(key, comment, unencryptedOpenSSHMarshaler)
+}
+
+// MarshalPrivateKeyWithPassphrase returns a PEM block holding the encrypted
+// private key serialized in the OpenSSH format.
+func MarshalPrivateKeyWithPassphrase(key crypto.PrivateKey, comment string, passphrase []byte) (*pem.Block, error) {
+	return marshalOpenSSHPrivateKey(key, comment, passphraseProtectedOpenSSHMarshaler(passphrase))
+}
+
 // PublicKey represents a public key using an unspecified algorithm.
 //
 // Some PublicKeys provided by this package also implement CryptoPublicKey.
@@ -321,7 +335,7 @@ type CryptoPublicKey interface {
 
 // A Signer can create signatures that verify against a public key.
 //
-// Some Signers provided by this package also implement AlgorithmSigner.
+// Some Signers provided by this package also implement MultiAlgorithmSigner.
 type Signer interface {
 	// PublicKey returns the associated PublicKey.
 	PublicKey() PublicKey
@@ -336,9 +350,9 @@ type Signer interface {
 // An AlgorithmSigner is a Signer that also supports specifying an algorithm to
 // use for signing.
 //
-// An AlgorithmSigner can't advertise the algorithms it supports, so it should
-// be prepared to be invoked with every algorithm supported by the public key
-// format.
+// An AlgorithmSigner can't advertise the algorithms it supports, unless it also
+// implements MultiAlgorithmSigner, so it should be prepared to be invoked with
+// every algorithm supported by the public key format.
 type AlgorithmSigner interface {
 	Signer
 
@@ -349,6 +363,75 @@ type AlgorithmSigner interface {
 	SignWithAlgorithm(rand io.Reader, data []byte, algorithm string) (*Signature, error)
 }
 
+// MultiAlgorithmSigner is an AlgorithmSigner that also reports the algorithms
+// supported by that signer.
+type MultiAlgorithmSigner interface {
+	AlgorithmSigner
+
+	// Algorithms returns the available algorithms in preference order. The list
+	// must not be empty, and it must not include certificate types.
+	Algorithms() []string
+}
+
+// NewSignerWithAlgorithms returns a signer restricted to the specified
+// algorithms. The algorithms must be set in preference order. The list must not
+// be empty, and it must not include certificate types. An error is returned if
+// the specified algorithms are incompatible with the public key type.
+func NewSignerWithAlgorithms(signer AlgorithmSigner, algorithms []string) (MultiAlgorithmSigner, error) {
+	if len(algorithms) == 0 {
+		return nil, errors.New("ssh: please specify at least one valid signing algorithm")
+	}
+	var signerAlgos []string
+	supportedAlgos := algorithmsForKeyFormat(underlyingAlgo(signer.PublicKey().Type()))
+	if s, ok := signer.(*multiAlgorithmSigner); ok {
+		signerAlgos = s.Algorithms()
+	} else {
+		signerAlgos = supportedAlgos
+	}
+
+	for _, algo := range algorithms {
+		if !contains(supportedAlgos, algo) {
+			return nil, fmt.Errorf("ssh: algorithm %q is not supported for key type %q",
+				algo, signer.PublicKey().Type())
+		}
+		if !contains(signerAlgos, algo) {
+			return nil, fmt.Errorf("ssh: algorithm %q is restricted for the provided signer", algo)
+		}
+	}
+	return &multiAlgorithmSigner{
+		AlgorithmSigner:     signer,
+		supportedAlgorithms: algorithms,
+	}, nil
+}
+
+type multiAlgorithmSigner struct {
+	AlgorithmSigner
+	supportedAlgorithms []string
+}
+
+func (s *multiAlgorithmSigner) Algorithms() []string {
+	return s.supportedAlgorithms
+}
+
+func (s *multiAlgorithmSigner) isAlgorithmSupported(algorithm string) bool {
+	if algorithm == "" {
+		algorithm = underlyingAlgo(s.PublicKey().Type())
+	}
+	for _, algo := range s.supportedAlgorithms {
+		if algorithm == algo {
+			return true
+		}
+	}
+	return false
+}
+
+func (s *multiAlgorithmSigner) SignWithAlgorithm(rand io.Reader, data []byte, algorithm string) (*Signature, error) {
+	if !s.isAlgorithmSupported(algorithm) {
+		return nil, fmt.Errorf("ssh: algorithm %q is not supported: %v", algorithm, s.supportedAlgorithms)
+	}
+	return s.AlgorithmSigner.SignWithAlgorithm(rand, data, algorithm)
+}
+
 type rsaPublicKey rsa.PublicKey
 
 func (r *rsaPublicKey) Type() string {
@@ -512,6 +595,10 @@ func (k *dsaPrivateKey) Sign(rand io.Reader, data []byte) (*Signature, error) {
 	return k.SignWithAlgorithm(rand, data, k.PublicKey().Type())
 }
 
+func (k *dsaPrivateKey) Algorithms() []string {
+	return []string{k.PublicKey().Type()}
+}
+
 func (k *dsaPrivateKey) SignWithAlgorithm(rand io.Reader, data []byte, algorithm string) (*Signature, error) {
 	if algorithm != "" && algorithm != k.PublicKey().Type() {
 		return nil, fmt.Errorf("ssh: unsupported signature algorithm %s", algorithm)
@@ -961,13 +1048,16 @@ func (s *wrappedSigner) Sign(rand io.Reader, data []byte) (*Signature, error) {
 	return s.SignWithAlgorithm(rand, data, s.pubKey.Type())
 }
 
+func (s *wrappedSigner) Algorithms() []string {
+	return algorithmsForKeyFormat(s.pubKey.Type())
+}
+
 func (s *wrappedSigner) SignWithAlgorithm(rand io.Reader, data []byte, algorithm string) (*Signature, error) {
 	if algorithm == "" {
 		algorithm = s.pubKey.Type()
 	}
 
-	supportedAlgos := algorithmsForKeyFormat(s.pubKey.Type())
-	if !contains(supportedAlgos, algorithm) {
+	if !contains(s.Algorithms(), algorithm) {
 		return nil, fmt.Errorf("ssh: unsupported signature algorithm %q for key format %q", algorithm, s.pubKey.Type())
 	}
 
@@ -1241,28 +1331,106 @@ func passphraseProtectedOpenSSHKey(passphrase []byte) openSSHDecryptFunc {
 	}
 }
 
+func unencryptedOpenSSHMarshaler(privKeyBlock []byte) ([]byte, string, string, string, error) {
+	key := generateOpenSSHPadding(privKeyBlock, 8)
+	return key, "none", "none", "", nil
+}
+
+func passphraseProtectedOpenSSHMarshaler(passphrase []byte) openSSHEncryptFunc {
+	return func(privKeyBlock []byte) ([]byte, string, string, string, error) {
+		salt := make([]byte, 16)
+		if _, err := rand.Read(salt); err != nil {
+			return nil, "", "", "", err
+		}
+
+		opts := struct {
+			Salt   []byte
+			Rounds uint32
+		}{salt, 16}
+
+		// Derive key to encrypt the private key block.
+		k, err := bcrypt_pbkdf.Key(passphrase, salt, int(opts.Rounds), 32+aes.BlockSize)
+		if err != nil {
+			return nil, "", "", "", err
+		}
+
+		// Add padding matching the block size of AES.
+		keyBlock := generateOpenSSHPadding(privKeyBlock, aes.BlockSize)
+
+		// Encrypt the private key using the derived secret.
+
+		dst := make([]byte, len(keyBlock))
+		key, iv := k[:32], k[32:]
+		block, err := aes.NewCipher(key)
+		if err != nil {
+			return nil, "", "", "", err
+		}
+
+		stream := cipher.NewCTR(block, iv)
+		stream.XORKeyStream(dst, keyBlock)
+
+		return dst, "aes256-ctr", "bcrypt", string(Marshal(opts)), nil
+	}
+}
+
+const privateKeyAuthMagic = "openssh-key-v1\x00"
+
 type openSSHDecryptFunc func(CipherName, KdfName, KdfOpts string, PrivKeyBlock []byte) ([]byte, error)
+type openSSHEncryptFunc func(PrivKeyBlock []byte) (ProtectedKeyBlock []byte, cipherName, kdfName, kdfOptions string, err error)
+
+type openSSHEncryptedPrivateKey struct {
+	CipherName   string
+	KdfName      string
+	KdfOpts      string
+	NumKeys      uint32
+	PubKey       []byte
+	PrivKeyBlock []byte
+}
+
+type openSSHPrivateKey struct {
+	Check1  uint32
+	Check2  uint32
+	Keytype string
+	Rest    []byte `ssh:"rest"`
+}
+
+type openSSHRSAPrivateKey struct {
+	N       *big.Int
+	E       *big.Int
+	D       *big.Int
+	Iqmp    *big.Int
+	P       *big.Int
+	Q       *big.Int
+	Comment string
+	Pad     []byte `ssh:"rest"`
+}
+
+type openSSHEd25519PrivateKey struct {
+	Pub     []byte
+	Priv    []byte
+	Comment string
+	Pad     []byte `ssh:"rest"`
+}
+
+type openSSHECDSAPrivateKey struct {
+	Curve   string
+	Pub     []byte
+	D       *big.Int
+	Comment string
+	Pad     []byte `ssh:"rest"`
+}
 
 // parseOpenSSHPrivateKey parses an OpenSSH private key, using the decrypt
 // function to unwrap the encrypted portion. unencryptedOpenSSHKey can be used
 // as the decrypt function to parse an unencrypted private key. See
 // https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.key.
 func parseOpenSSHPrivateKey(key []byte, decrypt openSSHDecryptFunc) (crypto.PrivateKey, error) {
-	const magic = "openssh-key-v1\x00"
-	if len(key) < len(magic) || string(key[:len(magic)]) != magic {
+	if len(key) < len(privateKeyAuthMagic) || string(key[:len(privateKeyAuthMagic)]) != privateKeyAuthMagic {
 		return nil, errors.New("ssh: invalid openssh private key format")
 	}
-	remaining := key[len(magic):]
-
-	var w struct {
-		CipherName   string
-		KdfName      string
-		KdfOpts      string
-		NumKeys      uint32
-		PubKey       []byte
-		PrivKeyBlock []byte
-	}
+	remaining := key[len(privateKeyAuthMagic):]
 
+	var w openSSHEncryptedPrivateKey
 	if err := Unmarshal(remaining, &w); err != nil {
 		return nil, err
 	}
@@ -1284,13 +1452,7 @@ func parseOpenSSHPrivateKey(key []byte, decrypt openSSHDecryptFunc) (crypto.Priv
 		return nil, err
 	}
 
-	pk1 := struct {
-		Check1  uint32
-		Check2  uint32
-		Keytype string
-		Rest    []byte `ssh:"rest"`
-	}{}
-
+	var pk1 openSSHPrivateKey
 	if err := Unmarshal(privKeyBlock, &pk1); err != nil || pk1.Check1 != pk1.Check2 {
 		if w.CipherName != "none" {
 			return nil, x509.IncorrectPasswordError
@@ -1300,18 +1462,7 @@ func parseOpenSSHPrivateKey(key []byte, decrypt openSSHDecryptFunc) (crypto.Priv
 
 	switch pk1.Keytype {
 	case KeyAlgoRSA:
-		// https://github.com/openssh/openssh-portable/blob/master/sshkey.c#L2760-L2773
-		key := struct {
-			N       *big.Int
-			E       *big.Int
-			D       *big.Int
-			Iqmp    *big.Int
-			P       *big.Int
-			Q       *big.Int
-			Comment string
-			Pad     []byte `ssh:"rest"`
-		}{}
-
+		var key openSSHRSAPrivateKey
 		if err := Unmarshal(pk1.Rest, &key); err != nil {
 			return nil, err
 		}
@@ -1337,13 +1488,7 @@ func parseOpenSSHPrivateKey(key []byte, decrypt openSSHDecryptFunc) (crypto.Priv
 
 		return pk, nil
 	case KeyAlgoED25519:
-		key := struct {
-			Pub     []byte
-			Priv    []byte
-			Comment string
-			Pad     []byte `ssh:"rest"`
-		}{}
-
+		var key openSSHEd25519PrivateKey
 		if err := Unmarshal(pk1.Rest, &key); err != nil {
 			return nil, err
 		}
@@ -1360,14 +1505,7 @@ func parseOpenSSHPrivateKey(key []byte, decrypt openSSHDecryptFunc) (crypto.Priv
 		copy(pk, key.Priv)
 		return &pk, nil
 	case KeyAlgoECDSA256, KeyAlgoECDSA384, KeyAlgoECDSA521:
-		key := struct {
-			Curve   string
-			Pub     []byte
-			D       *big.Int
-			Comment string
-			Pad     []byte `ssh:"rest"`
-		}{}
-
+		var key openSSHECDSAPrivateKey
 		if err := Unmarshal(pk1.Rest, &key); err != nil {
 			return nil, err
 		}
@@ -1415,6 +1553,131 @@ func parseOpenSSHPrivateKey(key []byte, decrypt openSSHDecryptFunc) (crypto.Priv
 	}
 }
 
+func marshalOpenSSHPrivateKey(key crypto.PrivateKey, comment string, encrypt openSSHEncryptFunc) (*pem.Block, error) {
+	var w openSSHEncryptedPrivateKey
+	var pk1 openSSHPrivateKey
+
+	// Random check bytes.
+	var check uint32
+	if err := binary.Read(rand.Reader, binary.BigEndian, &check); err != nil {
+		return nil, err
+	}
+
+	pk1.Check1 = check
+	pk1.Check2 = check
+	w.NumKeys = 1
+
+	// Use a []byte directly on ed25519 keys.
+	if k, ok := key.(*ed25519.PrivateKey); ok {
+		key = *k
+	}
+
+	switch k := key.(type) {
+	case *rsa.PrivateKey:
+		E := new(big.Int).SetInt64(int64(k.PublicKey.E))
+		// Marshal public key:
+		// E and N are in reversed order in the public and private key.
+		pubKey := struct {
+			KeyType string
+			E       *big.Int
+			N       *big.Int
+		}{
+			KeyAlgoRSA,
+			E, k.PublicKey.N,
+		}
+		w.PubKey = Marshal(pubKey)
+
+		// Marshal private key.
+		key := openSSHRSAPrivateKey{
+			N:       k.PublicKey.N,
+			E:       E,
+			D:       k.D,
+			Iqmp:    k.Precomputed.Qinv,
+			P:       k.Primes[0],
+			Q:       k.Primes[1],
+			Comment: comment,
+		}
+		pk1.Keytype = KeyAlgoRSA
+		pk1.Rest = Marshal(key)
+	case ed25519.PrivateKey:
+		pub := make([]byte, ed25519.PublicKeySize)
+		priv := make([]byte, ed25519.PrivateKeySize)
+		copy(pub, k[32:])
+		copy(priv, k)
+
+		// Marshal public key.
+		pubKey := struct {
+			KeyType string
+			Pub     []byte
+		}{
+			KeyAlgoED25519, pub,
+		}
+		w.PubKey = Marshal(pubKey)
+
+		// Marshal private key.
+		key := openSSHEd25519PrivateKey{
+			Pub:     pub,
+			Priv:    priv,
+			Comment: comment,
+		}
+		pk1.Keytype = KeyAlgoED25519
+		pk1.Rest = Marshal(key)
+	case *ecdsa.PrivateKey:
+		var curve, keyType string
+		switch name := k.Curve.Params().Name; name {
+		case "P-256":
+			curve = "nistp256"
+			keyType = KeyAlgoECDSA256
+		case "P-384":
+			curve = "nistp384"
+			keyType = KeyAlgoECDSA384
+		case "P-521":
+			curve = "nistp521"
+			keyType = KeyAlgoECDSA521
+		default:
+			return nil, errors.New("ssh: unhandled elliptic curve " + name)
+		}
+
+		pub := elliptic.Marshal(k.Curve, k.PublicKey.X, k.PublicKey.Y)
+
+		// Marshal public key.
+		pubKey := struct {
+			KeyType string
+			Curve   string
+			Pub     []byte
+		}{
+			keyType, curve, pub,
+		}
+		w.PubKey = Marshal(pubKey)
+
+		// Marshal private key.
+		key := openSSHECDSAPrivateKey{
+			Curve:   curve,
+			Pub:     pub,
+			D:       k.D,
+			Comment: comment,
+		}
+		pk1.Keytype = keyType
+		pk1.Rest = Marshal(key)
+	default:
+		return nil, fmt.Errorf("ssh: unsupported key type %T", k)
+	}
+
+	var err error
+	// Add padding and encrypt the key if necessary.
+	w.PrivKeyBlock, w.CipherName, w.KdfName, w.KdfOpts, err = encrypt(Marshal(pk1))
+	if err != nil {
+		return nil, err
+	}
+
+	b := Marshal(w)
+	block := &pem.Block{
+		Type:  "OPENSSH PRIVATE KEY",
+		Bytes: append([]byte(privateKeyAuthMagic), b...),
+	}
+	return block, nil
+}
+
 func checkOpenSSHKeyPadding(pad []byte) error {
 	for i, b := range pad {
 		if int(b) != i+1 {
@@ -1424,6 +1687,13 @@ func checkOpenSSHKeyPadding(pad []byte) error {
 	return nil
 }
 
+func generateOpenSSHPadding(block []byte, blockSize int) []byte {
+	for i, l := 0, len(block); (l+i)%blockSize != 0; i++ {
+		block = append(block, byte(i+1))
+	}
+	return block
+}
+
 // FingerprintLegacyMD5 returns the user presentation of the key's
 // fingerprint as described by RFC 4716 section 4.
 func FingerprintLegacyMD5(pubKey PublicKey) string {
diff --git a/vendor/golang.org/x/crypto/ssh/messages.go b/vendor/golang.org/x/crypto/ssh/messages.go
index 922032d95..b55f86056 100644
--- a/vendor/golang.org/x/crypto/ssh/messages.go
+++ b/vendor/golang.org/x/crypto/ssh/messages.go
@@ -349,6 +349,20 @@ type userAuthGSSAPIError struct {
 	LanguageTag string
 }
 
+// Transport layer OpenSSH extension. See [PROTOCOL], section 1.9
+const msgPing = 192
+
+type pingMsg struct {
+	Data string `sshtype:"192"`
+}
+
+// Transport layer OpenSSH extension. See [PROTOCOL], section 1.9
+const msgPong = 193
+
+type pongMsg struct {
+	Data string `sshtype:"193"`
+}
+
 // typeTags returns the possible type bytes for the given reflect.Type, which
 // should be a struct. The possible values are separated by a '|' character.
 func typeTags(structType reflect.Type) (tags []byte) {
diff --git a/vendor/golang.org/x/crypto/ssh/mux.go b/vendor/golang.org/x/crypto/ssh/mux.go
index 9654c0186..d2d24c635 100644
--- a/vendor/golang.org/x/crypto/ssh/mux.go
+++ b/vendor/golang.org/x/crypto/ssh/mux.go
@@ -231,6 +231,12 @@ func (m *mux) onePacket() error {
 		return m.handleChannelOpen(packet)
 	case msgGlobalRequest, msgRequestSuccess, msgRequestFailure:
 		return m.handleGlobalPacket(packet)
+	case msgPing:
+		var msg pingMsg
+		if err := Unmarshal(packet, &msg); err != nil {
+			return fmt.Errorf("failed to unmarshal ping@openssh.com message: %w", err)
+		}
+		return m.sendMessage(pongMsg(msg))
 	}
 
 	// assume a channel packet.
diff --git a/vendor/golang.org/x/crypto/ssh/server.go b/vendor/golang.org/x/crypto/ssh/server.go
index b21322aff..727c71b9c 100644
--- a/vendor/golang.org/x/crypto/ssh/server.go
+++ b/vendor/golang.org/x/crypto/ssh/server.go
@@ -576,7 +576,16 @@ userAuthLoop:
 				if !ok || len(payload) > 0 {
 					return nil, parseError(msgUserAuthRequest)
 				}
-
+				// Ensure the declared public key algo is compatible with the
+				// decoded one. This check will ensure we don't accept e.g.
+				// ssh-rsa-cert-v01@openssh.com algorithm with ssh-rsa public
+				// key type. The algorithm and public key type must be
+				// consistent: both must be certificate algorithms, or neither.
+				if !contains(algorithmsForKeyFormat(pubKey.Type()), algo) {
+					authErr = fmt.Errorf("ssh: public key type %q not compatible with selected algorithm %q",
+						pubKey.Type(), algo)
+					break
+				}
 				// Ensure the public key algo and signature algo
 				// are supported.  Compare the private key
 				// algorithm name that corresponds to algo with
diff --git a/vendor/golang.org/x/net/http2/server.go b/vendor/golang.org/x/net/http2/server.go
index 6d5e00887..02c88b6b3 100644
--- a/vendor/golang.org/x/net/http2/server.go
+++ b/vendor/golang.org/x/net/http2/server.go
@@ -581,9 +581,11 @@ type serverConn struct {
 	advMaxStreams               uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client
 	curClientStreams            uint32 // number of open streams initiated by the client
 	curPushedStreams            uint32 // number of open streams initiated by server push
+	curHandlers                 uint32 // number of running handler goroutines
 	maxClientStreamID           uint32 // max ever seen from client (odd), or 0 if there have been no client requests
 	maxPushPromiseID            uint32 // ID of the last push promise (even), or 0 if there have been no pushes
 	streams                     map[uint32]*stream
+	unstartedHandlers           []unstartedHandler
 	initialStreamSendWindowSize int32
 	maxFrameSize                int32
 	peerMaxHeaderListSize       uint32            // zero means unknown (default)
@@ -981,6 +983,8 @@ func (sc *serverConn) serve() {
 					return
 				case gracefulShutdownMsg:
 					sc.startGracefulShutdownInternal()
+				case handlerDoneMsg:
+					sc.handlerDone()
 				default:
 					panic("unknown timer")
 				}
@@ -1020,6 +1024,7 @@ var (
 	idleTimerMsg        = new(serverMessage)
 	shutdownTimerMsg    = new(serverMessage)
 	gracefulShutdownMsg = new(serverMessage)
+	handlerDoneMsg      = new(serverMessage)
 )
 
 func (sc *serverConn) onSettingsTimer() { sc.sendServeMsg(settingsTimerMsg) }
@@ -1892,9 +1897,11 @@ func (st *stream) copyTrailersToHandlerRequest() {
 // onReadTimeout is run on its own goroutine (from time.AfterFunc)
 // when the stream's ReadTimeout has fired.
 func (st *stream) onReadTimeout() {
-	// Wrap the ErrDeadlineExceeded to avoid callers depending on us
-	// returning the bare error.
-	st.body.CloseWithError(fmt.Errorf("%w", os.ErrDeadlineExceeded))
+	if st.body != nil {
+		// Wrap the ErrDeadlineExceeded to avoid callers depending on us
+		// returning the bare error.
+		st.body.CloseWithError(fmt.Errorf("%w", os.ErrDeadlineExceeded))
+	}
 }
 
 // onWriteTimeout is run on its own goroutine (from time.AfterFunc)
@@ -2012,13 +2019,10 @@ func (sc *serverConn) processHeaders(f *MetaHeadersFrame) error {
 	// (in Go 1.8), though. That's a more sane option anyway.
 	if sc.hs.ReadTimeout != 0 {
 		sc.conn.SetReadDeadline(time.Time{})
-		if st.body != nil {
-			st.readDeadline = time.AfterFunc(sc.hs.ReadTimeout, st.onReadTimeout)
-		}
+		st.readDeadline = time.AfterFunc(sc.hs.ReadTimeout, st.onReadTimeout)
 	}
 
-	go sc.runHandler(rw, req, handler)
-	return nil
+	return sc.scheduleHandler(id, rw, req, handler)
 }
 
 func (sc *serverConn) upgradeRequest(req *http.Request) {
@@ -2038,6 +2042,10 @@ func (sc *serverConn) upgradeRequest(req *http.Request) {
 		sc.conn.SetReadDeadline(time.Time{})
 	}
 
+	// This is the first request on the connection,
+	// so start the handler directly rather than going
+	// through scheduleHandler.
+	sc.curHandlers++
 	go sc.runHandler(rw, req, sc.handler.ServeHTTP)
 }
 
@@ -2278,8 +2286,62 @@ func (sc *serverConn) newResponseWriter(st *stream, req *http.Request) *response
 	return &responseWriter{rws: rws}
 }
 
+type unstartedHandler struct {
+	streamID uint32
+	rw       *responseWriter
+	req      *http.Request
+	handler  func(http.ResponseWriter, *http.Request)
+}
+
+// scheduleHandler starts a handler goroutine,
+// or schedules one to start as soon as an existing handler finishes.
+func (sc *serverConn) scheduleHandler(streamID uint32, rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) error {
+	sc.serveG.check()
+	maxHandlers := sc.advMaxStreams
+	if sc.curHandlers < maxHandlers {
+		sc.curHandlers++
+		go sc.runHandler(rw, req, handler)
+		return nil
+	}
+	if len(sc.unstartedHandlers) > int(4*sc.advMaxStreams) {
+		return sc.countError("too_many_early_resets", ConnectionError(ErrCodeEnhanceYourCalm))
+	}
+	sc.unstartedHandlers = append(sc.unstartedHandlers, unstartedHandler{
+		streamID: streamID,
+		rw:       rw,
+		req:      req,
+		handler:  handler,
+	})
+	return nil
+}
+
+func (sc *serverConn) handlerDone() {
+	sc.serveG.check()
+	sc.curHandlers--
+	i := 0
+	maxHandlers := sc.advMaxStreams
+	for ; i < len(sc.unstartedHandlers); i++ {
+		u := sc.unstartedHandlers[i]
+		if sc.streams[u.streamID] == nil {
+			// This stream was reset before its goroutine had a chance to start.
+			continue
+		}
+		if sc.curHandlers >= maxHandlers {
+			break
+		}
+		sc.curHandlers++
+		go sc.runHandler(u.rw, u.req, u.handler)
+		sc.unstartedHandlers[i] = unstartedHandler{} // don't retain references
+	}
+	sc.unstartedHandlers = sc.unstartedHandlers[i:]
+	if len(sc.unstartedHandlers) == 0 {
+		sc.unstartedHandlers = nil
+	}
+}
+
 // Run on its own goroutine.
 func (sc *serverConn) runHandler(rw *responseWriter, req *http.Request, handler func(http.ResponseWriter, *http.Request)) {
+	defer sc.sendServeMsg(handlerDoneMsg)
 	didPanic := true
 	defer func() {
 		rw.rws.stream.cancelCtx()
diff --git a/vendor/golang.org/x/oauth2/deviceauth.go b/vendor/golang.org/x/oauth2/deviceauth.go
new file mode 100644
index 000000000..e99c92f39
--- /dev/null
+++ b/vendor/golang.org/x/oauth2/deviceauth.go
@@ -0,0 +1,198 @@
+package oauth2
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+
+	"golang.org/x/oauth2/internal"
+)
+
+// https://datatracker.ietf.org/doc/html/rfc8628#section-3.5
+const (
+	errAuthorizationPending = "authorization_pending"
+	errSlowDown             = "slow_down"
+	errAccessDenied         = "access_denied"
+	errExpiredToken         = "expired_token"
+)
+
+// DeviceAuthResponse describes a successful RFC 8628 Device Authorization Response
+// https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
+type DeviceAuthResponse struct {
+	// DeviceCode
+	DeviceCode string `json:"device_code"`
+	// UserCode is the code the user should enter at the verification uri
+	UserCode string `json:"user_code"`
+	// VerificationURI is where user should enter the user code
+	VerificationURI string `json:"verification_uri"`
+	// VerificationURIComplete (if populated) includes the user code in the verification URI. This is typically shown to the user in non-textual form, such as a QR code.
+	VerificationURIComplete string `json:"verification_uri_complete,omitempty"`
+	// Expiry is when the device code and user code expire
+	Expiry time.Time `json:"expires_in,omitempty"`
+	// Interval is the duration in seconds that Poll should wait between requests
+	Interval int64 `json:"interval,omitempty"`
+}
+
+func (d DeviceAuthResponse) MarshalJSON() ([]byte, error) {
+	type Alias DeviceAuthResponse
+	var expiresIn int64
+	if !d.Expiry.IsZero() {
+		expiresIn = int64(time.Until(d.Expiry).Seconds())
+	}
+	return json.Marshal(&struct {
+		ExpiresIn int64 `json:"expires_in,omitempty"`
+		*Alias
+	}{
+		ExpiresIn: expiresIn,
+		Alias:     (*Alias)(&d),
+	})
+
+}
+
+func (c *DeviceAuthResponse) UnmarshalJSON(data []byte) error {
+	type Alias DeviceAuthResponse
+	aux := &struct {
+		ExpiresIn int64 `json:"expires_in"`
+		// workaround misspelling of verification_uri
+		VerificationURL string `json:"verification_url"`
+		*Alias
+	}{
+		Alias: (*Alias)(c),
+	}
+	if err := json.Unmarshal(data, &aux); err != nil {
+		return err
+	}
+	if aux.ExpiresIn != 0 {
+		c.Expiry = time.Now().UTC().Add(time.Second * time.Duration(aux.ExpiresIn))
+	}
+	if c.VerificationURI == "" {
+		c.VerificationURI = aux.VerificationURL
+	}
+	return nil
+}
+
+// DeviceAuth returns a device auth struct which contains a device code
+// and authorization information provided for users to enter on another device.
+func (c *Config) DeviceAuth(ctx context.Context, opts ...AuthCodeOption) (*DeviceAuthResponse, error) {
+	// https://datatracker.ietf.org/doc/html/rfc8628#section-3.1
+	v := url.Values{
+		"client_id": {c.ClientID},
+	}
+	if len(c.Scopes) > 0 {
+		v.Set("scope", strings.Join(c.Scopes, " "))
+	}
+	for _, opt := range opts {
+		opt.setValue(v)
+	}
+	return retrieveDeviceAuth(ctx, c, v)
+}
+
+func retrieveDeviceAuth(ctx context.Context, c *Config, v url.Values) (*DeviceAuthResponse, error) {
+	if c.Endpoint.DeviceAuthURL == "" {
+		return nil, errors.New("endpoint missing DeviceAuthURL")
+	}
+
+	req, err := http.NewRequest("POST", c.Endpoint.DeviceAuthURL, strings.NewReader(v.Encode()))
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	req.Header.Set("Accept", "application/json")
+
+	t := time.Now()
+	r, err := internal.ContextClient(ctx).Do(req)
+	if err != nil {
+		return nil, err
+	}
+
+	body, err := io.ReadAll(io.LimitReader(r.Body, 1<<20))
+	if err != nil {
+		return nil, fmt.Errorf("oauth2: cannot auth device: %v", err)
+	}
+	if code := r.StatusCode; code < 200 || code > 299 {
+		return nil, &RetrieveError{
+			Response: r,
+			Body:     body,
+		}
+	}
+
+	da := &DeviceAuthResponse{}
+	err = json.Unmarshal(body, &da)
+	if err != nil {
+		return nil, fmt.Errorf("unmarshal %s", err)
+	}
+
+	if !da.Expiry.IsZero() {
+		// Make a small adjustment to account for time taken by the request
+		da.Expiry = da.Expiry.Add(-time.Since(t))
+	}
+
+	return da, nil
+}
+
+// DeviceAccessToken polls the server to exchange a device code for a token.
+func (c *Config) DeviceAccessToken(ctx context.Context, da *DeviceAuthResponse, opts ...AuthCodeOption) (*Token, error) {
+	if !da.Expiry.IsZero() {
+		var cancel context.CancelFunc
+		ctx, cancel = context.WithDeadline(ctx, da.Expiry)
+		defer cancel()
+	}
+
+	// https://datatracker.ietf.org/doc/html/rfc8628#section-3.4
+	v := url.Values{
+		"client_id":   {c.ClientID},
+		"grant_type":  {"urn:ietf:params:oauth:grant-type:device_code"},
+		"device_code": {da.DeviceCode},
+	}
+	if len(c.Scopes) > 0 {
+		v.Set("scope", strings.Join(c.Scopes, " "))
+	}
+	for _, opt := range opts {
+		opt.setValue(v)
+	}
+
+	// "If no value is provided, clients MUST use 5 as the default."
+	// https://datatracker.ietf.org/doc/html/rfc8628#section-3.2
+	interval := da.Interval
+	if interval == 0 {
+		interval = 5
+	}
+
+	ticker := time.NewTicker(time.Duration(interval) * time.Second)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		case <-ticker.C:
+			tok, err := retrieveToken(ctx, c, v)
+			if err == nil {
+				return tok, nil
+			}
+
+			e, ok := err.(*RetrieveError)
+			if !ok {
+				return nil, err
+			}
+			switch e.ErrorCode {
+			case errSlowDown:
+				// https://datatracker.ietf.org/doc/html/rfc8628#section-3.5
+				// "the interval MUST be increased by 5 seconds for this and all subsequent requests"
+				interval += 5
+				ticker.Reset(time.Duration(interval) * time.Second)
+			case errAuthorizationPending:
+				// Do nothing.
+			case errAccessDenied, errExpiredToken:
+				fallthrough
+			default:
+				return tok, err
+			}
+		}
+	}
+}
diff --git a/vendor/golang.org/x/oauth2/google/default.go b/vendor/golang.org/x/oauth2/google/default.go
index 2cf71f0f9..12b12a30c 100644
--- a/vendor/golang.org/x/oauth2/google/default.go
+++ b/vendor/golang.org/x/oauth2/google/default.go
@@ -19,7 +19,10 @@ import (
 	"golang.org/x/oauth2/authhandler"
 )
 
-const adcSetupURL = "https://cloud.google.com/docs/authentication/external/set-up-adc"
+const (
+	adcSetupURL           = "https://cloud.google.com/docs/authentication/external/set-up-adc"
+	universeDomainDefault = "googleapis.com"
+)
 
 // Credentials holds Google credentials, including "Application Default Credentials".
 // For more details, see:
@@ -37,6 +40,18 @@ type Credentials struct {
 	// environment and not with a credentials file, e.g. when code is
 	// running on Google Cloud Platform.
 	JSON []byte
+
+	// universeDomain is the default service domain for a given Cloud universe.
+	universeDomain string
+}
+
+// UniverseDomain returns the default service domain for a given Cloud universe.
+// The default value is "googleapis.com".
+func (c *Credentials) UniverseDomain() string {
+	if c.universeDomain == "" {
+		return universeDomainDefault
+	}
+	return c.universeDomain
 }
 
 // DefaultCredentials is the old name of Credentials.
@@ -200,15 +215,23 @@ func CredentialsFromJSONWithParams(ctx context.Context, jsonData []byte, params
 	if err := json.Unmarshal(jsonData, &f); err != nil {
 		return nil, err
 	}
+
+	universeDomain := f.UniverseDomain
+	// Authorized user credentials are only supported in the googleapis.com universe.
+	if f.Type == userCredentialsKey {
+		universeDomain = universeDomainDefault
+	}
+
 	ts, err := f.tokenSource(ctx, params)
 	if err != nil {
 		return nil, err
 	}
 	ts = newErrWrappingTokenSource(ts)
 	return &Credentials{
-		ProjectID:   f.ProjectID,
-		TokenSource: ts,
-		JSON:        jsonData,
+		ProjectID:      f.ProjectID,
+		TokenSource:    ts,
+		JSON:           jsonData,
+		universeDomain: universeDomain,
 	}, nil
 }
 
diff --git a/vendor/golang.org/x/oauth2/google/google.go b/vendor/golang.org/x/oauth2/google/google.go
index cc1223889..c66c53527 100644
--- a/vendor/golang.org/x/oauth2/google/google.go
+++ b/vendor/golang.org/x/oauth2/google/google.go
@@ -16,14 +16,16 @@ import (
 	"cloud.google.com/go/compute/metadata"
 	"golang.org/x/oauth2"
 	"golang.org/x/oauth2/google/internal/externalaccount"
+	"golang.org/x/oauth2/google/internal/externalaccountauthorizeduser"
 	"golang.org/x/oauth2/jwt"
 )
 
 // Endpoint is Google's OAuth 2.0 default endpoint.
 var Endpoint = oauth2.Endpoint{
-	AuthURL:   "https://accounts.google.com/o/oauth2/auth",
-	TokenURL:  "https://oauth2.googleapis.com/token",
-	AuthStyle: oauth2.AuthStyleInParams,
+	AuthURL:       "https://accounts.google.com/o/oauth2/auth",
+	TokenURL:      "https://oauth2.googleapis.com/token",
+	DeviceAuthURL: "https://oauth2.googleapis.com/device/code",
+	AuthStyle:     oauth2.AuthStyleInParams,
 }
 
 // MTLSTokenURL is Google's OAuth 2.0 default mTLS endpoint.
@@ -95,10 +97,11 @@ func JWTConfigFromJSON(jsonKey []byte, scope ...string) (*jwt.Config, error) {
 
 // JSON key file types.
 const (
-	serviceAccountKey          = "service_account"
-	userCredentialsKey         = "authorized_user"
-	externalAccountKey         = "external_account"
-	impersonatedServiceAccount = "impersonated_service_account"
+	serviceAccountKey                = "service_account"
+	userCredentialsKey               = "authorized_user"
+	externalAccountKey               = "external_account"
+	externalAccountAuthorizedUserKey = "external_account_authorized_user"
+	impersonatedServiceAccount       = "impersonated_service_account"
 )
 
 // credentialsFile is the unmarshalled representation of a credentials file.
@@ -106,12 +109,13 @@ type credentialsFile struct {
 	Type string `json:"type"`
 
 	// Service Account fields
-	ClientEmail  string `json:"client_email"`
-	PrivateKeyID string `json:"private_key_id"`
-	PrivateKey   string `json:"private_key"`
-	AuthURL      string `json:"auth_uri"`
-	TokenURL     string `json:"token_uri"`
-	ProjectID    string `json:"project_id"`
+	ClientEmail    string `json:"client_email"`
+	PrivateKeyID   string `json:"private_key_id"`
+	PrivateKey     string `json:"private_key"`
+	AuthURL        string `json:"auth_uri"`
+	TokenURL       string `json:"token_uri"`
+	ProjectID      string `json:"project_id"`
+	UniverseDomain string `json:"universe_domain"`
 
 	// User Credential fields
 	// (These typically come from gcloud auth.)
@@ -131,6 +135,9 @@ type credentialsFile struct {
 	QuotaProjectID                 string                           `json:"quota_project_id"`
 	WorkforcePoolUserProject       string                           `json:"workforce_pool_user_project"`
 
+	// External Account Authorized User fields
+	RevokeURL string `json:"revoke_url"`
+
 	// Service account impersonation
 	SourceCredentials *credentialsFile `json:"source_credentials"`
 }
@@ -199,6 +206,19 @@ func (f *credentialsFile) tokenSource(ctx context.Context, params CredentialsPar
 			WorkforcePoolUserProject: f.WorkforcePoolUserProject,
 		}
 		return cfg.TokenSource(ctx)
+	case externalAccountAuthorizedUserKey:
+		cfg := &externalaccountauthorizeduser.Config{
+			Audience:       f.Audience,
+			RefreshToken:   f.RefreshToken,
+			TokenURL:       f.TokenURLExternal,
+			TokenInfoURL:   f.TokenInfoURL,
+			ClientID:       f.ClientID,
+			ClientSecret:   f.ClientSecret,
+			RevokeURL:      f.RevokeURL,
+			QuotaProjectID: f.QuotaProjectID,
+			Scopes:         params.Scopes,
+		}
+		return cfg.TokenSource(ctx)
 	case impersonatedServiceAccount:
 		if f.ServiceAccountImpersonationURL == "" || f.SourceCredentials == nil {
 			return nil, errors.New("missing 'source_credentials' field or 'service_account_impersonation_url' in credentials")
diff --git a/vendor/golang.org/x/oauth2/google/internal/externalaccount/aws.go b/vendor/golang.org/x/oauth2/google/internal/externalaccount/aws.go
index 2bf3202b2..bd4efd19b 100644
--- a/vendor/golang.org/x/oauth2/google/internal/externalaccount/aws.go
+++ b/vendor/golang.org/x/oauth2/google/internal/externalaccount/aws.go
@@ -274,49 +274,6 @@ type awsRequest struct {
 	Headers []awsRequestHeader `json:"headers"`
 }
 
-func (cs awsCredentialSource) validateMetadataServers() error {
-	if err := cs.validateMetadataServer(cs.RegionURL, "region_url"); err != nil {
-		return err
-	}
-	if err := cs.validateMetadataServer(cs.CredVerificationURL, "url"); err != nil {
-		return err
-	}
-	return cs.validateMetadataServer(cs.IMDSv2SessionTokenURL, "imdsv2_session_token_url")
-}
-
-var validHostnames []string = []string{"169.254.169.254", "fd00:ec2::254"}
-
-func (cs awsCredentialSource) isValidMetadataServer(metadataUrl string) bool {
-	if metadataUrl == "" {
-		// Zero value means use default, which is valid.
-		return true
-	}
-
-	u, err := url.Parse(metadataUrl)
-	if err != nil {
-		// Unparseable URL means invalid
-		return false
-	}
-
-	for _, validHostname := range validHostnames {
-		if u.Hostname() == validHostname {
-			// If it's one of the valid hostnames, everything is good
-			return true
-		}
-	}
-
-	// hostname not found in our allowlist, so not valid
-	return false
-}
-
-func (cs awsCredentialSource) validateMetadataServer(metadataUrl, urlName string) error {
-	if !cs.isValidMetadataServer(metadataUrl) {
-		return fmt.Errorf("oauth2/google: invalid hostname %s for %s", metadataUrl, urlName)
-	}
-
-	return nil
-}
-
 func (cs awsCredentialSource) doRequest(req *http.Request) (*http.Response, error) {
 	if cs.client == nil {
 		cs.client = oauth2.NewClient(cs.ctx, nil)
@@ -339,6 +296,10 @@ func shouldUseMetadataServer() bool {
 	return !canRetrieveRegionFromEnvironment() || !canRetrieveSecurityCredentialFromEnvironment()
 }
 
+func (cs awsCredentialSource) credentialSourceType() string {
+	return "aws"
+}
+
 func (cs awsCredentialSource) subjectToken() (string, error) {
 	if cs.requestSigner == nil {
 		headers := make(map[string]string)
diff --git a/vendor/golang.org/x/oauth2/google/internal/externalaccount/basecredentials.go b/vendor/golang.org/x/oauth2/google/internal/externalaccount/basecredentials.go
index dcd252a61..33288d367 100644
--- a/vendor/golang.org/x/oauth2/google/internal/externalaccount/basecredentials.go
+++ b/vendor/golang.org/x/oauth2/google/internal/externalaccount/basecredentials.go
@@ -8,13 +8,12 @@ import (
 	"context"
 	"fmt"
 	"net/http"
-	"net/url"
 	"regexp"
 	"strconv"
-	"strings"
 	"time"
 
 	"golang.org/x/oauth2"
+	"golang.org/x/oauth2/google/internal/stsexchange"
 )
 
 // now aliases time.Now for testing
@@ -63,31 +62,10 @@ type Config struct {
 	WorkforcePoolUserProject string
 }
 
-// Each element consists of a list of patterns.  validateURLs checks for matches
-// that include all elements in a given list, in that order.
-
 var (
 	validWorkforceAudiencePattern *regexp.Regexp = regexp.MustCompile(`//iam\.googleapis\.com/locations/[^/]+/workforcePools/`)
 )
 
-func validateURL(input string, patterns []*regexp.Regexp, scheme string) bool {
-	parsed, err := url.Parse(input)
-	if err != nil {
-		return false
-	}
-	if !strings.EqualFold(parsed.Scheme, scheme) {
-		return false
-	}
-	toTest := parsed.Host
-
-	for _, pattern := range patterns {
-		if pattern.MatchString(toTest) {
-			return true
-		}
-	}
-	return false
-}
-
 func validateWorkforceAudience(input string) bool {
 	return validWorkforceAudiencePattern.MatchString(input)
 }
@@ -185,10 +163,6 @@ func (c *Config) parse(ctx context.Context) (baseCredentialSource, error) {
 				awsCredSource.IMDSv2SessionTokenURL = c.CredentialSource.IMDSv2SessionTokenURL
 			}
 
-			if err := awsCredSource.validateMetadataServers(); err != nil {
-				return nil, err
-			}
-
 			return awsCredSource, nil
 		}
 	} else if c.CredentialSource.File != "" {
@@ -202,6 +176,7 @@ func (c *Config) parse(ctx context.Context) (baseCredentialSource, error) {
 }
 
 type baseCredentialSource interface {
+	credentialSourceType() string
 	subjectToken() (string, error)
 }
 
@@ -211,6 +186,15 @@ type tokenSource struct {
 	conf *Config
 }
 
+func getMetricsHeaderValue(conf *Config, credSource baseCredentialSource) string {
+	return fmt.Sprintf("gl-go/%s auth/%s google-byoid-sdk source/%s sa-impersonation/%t config-lifetime/%t",
+		goVersion(),
+		"unknown",
+		credSource.credentialSourceType(),
+		conf.ServiceAccountImpersonationURL != "",
+		conf.ServiceAccountImpersonationLifetimeSeconds != 0)
+}
+
 // Token allows tokenSource to conform to the oauth2.TokenSource interface.
 func (ts tokenSource) Token() (*oauth2.Token, error) {
 	conf := ts.conf
@@ -224,7 +208,7 @@ func (ts tokenSource) Token() (*oauth2.Token, error) {
 	if err != nil {
 		return nil, err
 	}
-	stsRequest := stsTokenExchangeRequest{
+	stsRequest := stsexchange.TokenExchangeRequest{
 		GrantType:          "urn:ietf:params:oauth:grant-type:token-exchange",
 		Audience:           conf.Audience,
 		Scope:              conf.Scopes,
@@ -234,7 +218,8 @@ func (ts tokenSource) Token() (*oauth2.Token, error) {
 	}
 	header := make(http.Header)
 	header.Add("Content-Type", "application/x-www-form-urlencoded")
-	clientAuth := clientAuthentication{
+	header.Add("x-goog-api-client", getMetricsHeaderValue(conf, credSource))
+	clientAuth := stsexchange.ClientAuthentication{
 		AuthStyle:    oauth2.AuthStyleInHeader,
 		ClientID:     conf.ClientID,
 		ClientSecret: conf.ClientSecret,
@@ -247,7 +232,7 @@ func (ts tokenSource) Token() (*oauth2.Token, error) {
 			"userProject": conf.WorkforcePoolUserProject,
 		}
 	}
-	stsResp, err := exchangeToken(ts.ctx, conf.TokenURL, &stsRequest, clientAuth, header, options)
+	stsResp, err := stsexchange.ExchangeToken(ts.ctx, conf.TokenURL, &stsRequest, clientAuth, header, options)
 	if err != nil {
 		return nil, err
 	}
diff --git a/vendor/golang.org/x/oauth2/google/internal/externalaccount/executablecredsource.go b/vendor/golang.org/x/oauth2/google/internal/externalaccount/executablecredsource.go
index 579bcce5f..6497dc022 100644
--- a/vendor/golang.org/x/oauth2/google/internal/externalaccount/executablecredsource.go
+++ b/vendor/golang.org/x/oauth2/google/internal/externalaccount/executablecredsource.go
@@ -233,6 +233,10 @@ func (cs executableCredentialSource) parseSubjectTokenFromSource(response []byte
 	return "", tokenTypeError(source)
 }
 
+func (cs executableCredentialSource) credentialSourceType() string {
+	return "executable"
+}
+
 func (cs executableCredentialSource) subjectToken() (string, error) {
 	if token, err := cs.getTokenFromOutputFile(); token != "" || err != nil {
 		return token, err
diff --git a/vendor/golang.org/x/oauth2/google/internal/externalaccount/filecredsource.go b/vendor/golang.org/x/oauth2/google/internal/externalaccount/filecredsource.go
index e953ddb47..f35f73c5c 100644
--- a/vendor/golang.org/x/oauth2/google/internal/externalaccount/filecredsource.go
+++ b/vendor/golang.org/x/oauth2/google/internal/externalaccount/filecredsource.go
@@ -19,6 +19,10 @@ type fileCredentialSource struct {
 	Format format
 }
 
+func (cs fileCredentialSource) credentialSourceType() string {
+	return "file"
+}
+
 func (cs fileCredentialSource) subjectToken() (string, error) {
 	tokenFile, err := os.Open(cs.File)
 	if err != nil {
diff --git a/vendor/golang.org/x/oauth2/google/internal/externalaccount/header.go b/vendor/golang.org/x/oauth2/google/internal/externalaccount/header.go
new file mode 100644
index 000000000..1d5aad2e2
--- /dev/null
+++ b/vendor/golang.org/x/oauth2/google/internal/externalaccount/header.go
@@ -0,0 +1,64 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package externalaccount
+
+import (
+	"runtime"
+	"strings"
+	"unicode"
+)
+
+var (
+	// version is a package internal global variable for testing purposes.
+	version = runtime.Version
+)
+
+// versionUnknown is only used when the runtime version cannot be determined.
+const versionUnknown = "UNKNOWN"
+
+// goVersion returns a Go runtime version derived from the runtime environment
+// that is modified to be suitable for reporting in a header, meaning it has no
+// whitespace. If it is unable to determine the Go runtime version, it returns
+// versionUnknown.
+func goVersion() string {
+	const develPrefix = "devel +"
+
+	s := version()
+	if strings.HasPrefix(s, develPrefix) {
+		s = s[len(develPrefix):]
+		if p := strings.IndexFunc(s, unicode.IsSpace); p >= 0 {
+			s = s[:p]
+		}
+		return s
+	} else if p := strings.IndexFunc(s, unicode.IsSpace); p >= 0 {
+		s = s[:p]
+	}
+
+	notSemverRune := func(r rune) bool {
+		return !strings.ContainsRune("0123456789.", r)
+	}
+
+	if strings.HasPrefix(s, "go1") {
+		s = s[2:]
+		var prerelease string
+		if p := strings.IndexFunc(s, notSemverRune); p >= 0 {
+			s, prerelease = s[:p], s[p:]
+		}
+		if strings.HasSuffix(s, ".") {
+			s += "0"
+		} else if strings.Count(s, ".") < 2 {
+			s += ".0"
+		}
+		if prerelease != "" {
+			// Some release candidates already have a dash in them.
+			if !strings.HasPrefix(prerelease, "-") {
+				prerelease = "-" + prerelease
+			}
+			s += prerelease
+		}
+		return s
+	}
+	return "UNKNOWN"
+}
diff --git a/vendor/golang.org/x/oauth2/google/internal/externalaccount/urlcredsource.go b/vendor/golang.org/x/oauth2/google/internal/externalaccount/urlcredsource.go
index 16dca6541..606bb4e80 100644
--- a/vendor/golang.org/x/oauth2/google/internal/externalaccount/urlcredsource.go
+++ b/vendor/golang.org/x/oauth2/google/internal/externalaccount/urlcredsource.go
@@ -23,6 +23,10 @@ type urlCredentialSource struct {
 	ctx     context.Context
 }
 
+func (cs urlCredentialSource) credentialSourceType() string {
+	return "url"
+}
+
 func (cs urlCredentialSource) subjectToken() (string, error) {
 	client := oauth2.NewClient(cs.ctx, nil)
 	req, err := http.NewRequest("GET", cs.URL, nil)
diff --git a/vendor/golang.org/x/oauth2/google/internal/externalaccountauthorizeduser/externalaccountauthorizeduser.go b/vendor/golang.org/x/oauth2/google/internal/externalaccountauthorizeduser/externalaccountauthorizeduser.go
new file mode 100644
index 000000000..cb5820707
--- /dev/null
+++ b/vendor/golang.org/x/oauth2/google/internal/externalaccountauthorizeduser/externalaccountauthorizeduser.go
@@ -0,0 +1,114 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package externalaccountauthorizeduser
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"golang.org/x/oauth2"
+	"golang.org/x/oauth2/google/internal/stsexchange"
+)
+
+// now aliases time.Now for testing.
+var now = func() time.Time {
+	return time.Now().UTC()
+}
+
+var tokenValid = func(token oauth2.Token) bool {
+	return token.Valid()
+}
+
+type Config struct {
+	// Audience is the Secure Token Service (STS) audience which contains the resource name for the workforce pool and
+	// the provider identifier in that pool.
+	Audience string
+	// RefreshToken is the optional OAuth 2.0 refresh token. If specified, credentials can be refreshed.
+	RefreshToken string
+	// TokenURL is the optional STS token exchange endpoint for refresh. Must be specified for refresh, can be left as
+	// None if the token can not be refreshed.
+	TokenURL string
+	// TokenInfoURL is the optional STS endpoint URL for token introspection.
+	TokenInfoURL string
+	// ClientID is only required in conjunction with ClientSecret, as described above.
+	ClientID string
+	// ClientSecret is currently only required if token_info endpoint also needs to be called with the generated GCP
+	// access token. When provided, STS will be called with additional basic authentication using client_id as username
+	// and client_secret as password.
+	ClientSecret string
+	// Token is the OAuth2.0 access token. Can be nil if refresh information is provided.
+	Token string
+	// Expiry is the optional expiration datetime of the OAuth 2.0 access token.
+	Expiry time.Time
+	// RevokeURL is the optional STS endpoint URL for revoking tokens.
+	RevokeURL string
+	// QuotaProjectID is the optional project ID used for quota and billing. This project may be different from the
+	// project used to create the credentials.
+	QuotaProjectID string
+	Scopes         []string
+}
+
+func (c *Config) canRefresh() bool {
+	return c.ClientID != "" && c.ClientSecret != "" && c.RefreshToken != "" && c.TokenURL != ""
+}
+
+func (c *Config) TokenSource(ctx context.Context) (oauth2.TokenSource, error) {
+	var token oauth2.Token
+	if c.Token != "" && !c.Expiry.IsZero() {
+		token = oauth2.Token{
+			AccessToken: c.Token,
+			Expiry:      c.Expiry,
+			TokenType:   "Bearer",
+		}
+	}
+	if !tokenValid(token) && !c.canRefresh() {
+		return nil, errors.New("oauth2/google: Token should be created with fields to make it valid (`token` and `expiry`), or fields to allow it to refresh (`refresh_token`, `token_url`, `client_id`, `client_secret`).")
+	}
+
+	ts := tokenSource{
+		ctx:  ctx,
+		conf: c,
+	}
+
+	return oauth2.ReuseTokenSource(&token, ts), nil
+}
+
+type tokenSource struct {
+	ctx  context.Context
+	conf *Config
+}
+
+func (ts tokenSource) Token() (*oauth2.Token, error) {
+	conf := ts.conf
+	if !conf.canRefresh() {
+		return nil, errors.New("oauth2/google: The credentials do not contain the necessary fields need to refresh the access token. You must specify refresh_token, token_url, client_id, and client_secret.")
+	}
+
+	clientAuth := stsexchange.ClientAuthentication{
+		AuthStyle:    oauth2.AuthStyleInHeader,
+		ClientID:     conf.ClientID,
+		ClientSecret: conf.ClientSecret,
+	}
+
+	stsResponse, err := stsexchange.RefreshAccessToken(ts.ctx, conf.TokenURL, conf.RefreshToken, clientAuth, nil)
+	if err != nil {
+		return nil, err
+	}
+	if stsResponse.ExpiresIn < 0 {
+		return nil, errors.New("oauth2/google: got invalid expiry from security token service")
+	}
+
+	if stsResponse.RefreshToken != "" {
+		conf.RefreshToken = stsResponse.RefreshToken
+	}
+
+	token := &oauth2.Token{
+		AccessToken: stsResponse.AccessToken,
+		Expiry:      now().Add(time.Duration(stsResponse.ExpiresIn) * time.Second),
+		TokenType:   "Bearer",
+	}
+	return token, nil
+}
diff --git a/vendor/golang.org/x/oauth2/google/internal/externalaccount/clientauth.go b/vendor/golang.org/x/oauth2/google/internal/stsexchange/clientauth.go
similarity index 88%
rename from vendor/golang.org/x/oauth2/google/internal/externalaccount/clientauth.go
rename to vendor/golang.org/x/oauth2/google/internal/stsexchange/clientauth.go
index 99987ce29..ebd520eac 100644
--- a/vendor/golang.org/x/oauth2/google/internal/externalaccount/clientauth.go
+++ b/vendor/golang.org/x/oauth2/google/internal/stsexchange/clientauth.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-package externalaccount
+package stsexchange
 
 import (
 	"encoding/base64"
@@ -12,8 +12,8 @@ import (
 	"golang.org/x/oauth2"
 )
 
-// clientAuthentication represents an OAuth client ID and secret and the mechanism for passing these credentials as stated in rfc6749#2.3.1.
-type clientAuthentication struct {
+// ClientAuthentication represents an OAuth client ID and secret and the mechanism for passing these credentials as stated in rfc6749#2.3.1.
+type ClientAuthentication struct {
 	// AuthStyle can be either basic or request-body
 	AuthStyle    oauth2.AuthStyle
 	ClientID     string
@@ -23,7 +23,7 @@ type clientAuthentication struct {
 // InjectAuthentication is used to add authentication to a Secure Token Service exchange
 // request.  It modifies either the passed url.Values or http.Header depending on the desired
 // authentication format.
-func (c *clientAuthentication) InjectAuthentication(values url.Values, headers http.Header) {
+func (c *ClientAuthentication) InjectAuthentication(values url.Values, headers http.Header) {
 	if c.ClientID == "" || c.ClientSecret == "" || values == nil || headers == nil {
 		return
 	}
diff --git a/vendor/golang.org/x/oauth2/google/internal/externalaccount/sts_exchange.go b/vendor/golang.org/x/oauth2/google/internal/stsexchange/sts_exchange.go
similarity index 68%
rename from vendor/golang.org/x/oauth2/google/internal/externalaccount/sts_exchange.go
rename to vendor/golang.org/x/oauth2/google/internal/stsexchange/sts_exchange.go
index e6fcae5fc..1a0bebd15 100644
--- a/vendor/golang.org/x/oauth2/google/internal/externalaccount/sts_exchange.go
+++ b/vendor/golang.org/x/oauth2/google/internal/stsexchange/sts_exchange.go
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-package externalaccount
+package stsexchange
 
 import (
 	"context"
@@ -18,14 +18,17 @@ import (
 	"golang.org/x/oauth2"
 )
 
-// exchangeToken performs an oauth2 token exchange with the provided endpoint.
+func defaultHeader() http.Header {
+	header := make(http.Header)
+	header.Add("Content-Type", "application/x-www-form-urlencoded")
+	return header
+}
+
+// ExchangeToken performs an oauth2 token exchange with the provided endpoint.
 // The first 4 fields are all mandatory.  headers can be used to pass additional
 // headers beyond the bare minimum required by the token exchange.  options can
 // be used to pass additional JSON-structured options to the remote server.
-func exchangeToken(ctx context.Context, endpoint string, request *stsTokenExchangeRequest, authentication clientAuthentication, headers http.Header, options map[string]interface{}) (*stsTokenExchangeResponse, error) {
-
-	client := oauth2.NewClient(ctx, nil)
-
+func ExchangeToken(ctx context.Context, endpoint string, request *TokenExchangeRequest, authentication ClientAuthentication, headers http.Header, options map[string]interface{}) (*Response, error) {
 	data := url.Values{}
 	data.Set("audience", request.Audience)
 	data.Set("grant_type", "urn:ietf:params:oauth:grant-type:token-exchange")
@@ -41,13 +44,28 @@ func exchangeToken(ctx context.Context, endpoint string, request *stsTokenExchan
 		data.Set("options", string(opts))
 	}
 
+	return makeRequest(ctx, endpoint, data, authentication, headers)
+}
+
+func RefreshAccessToken(ctx context.Context, endpoint string, refreshToken string, authentication ClientAuthentication, headers http.Header) (*Response, error) {
+	data := url.Values{}
+	data.Set("grant_type", "refresh_token")
+	data.Set("refresh_token", refreshToken)
+
+	return makeRequest(ctx, endpoint, data, authentication, headers)
+}
+
+func makeRequest(ctx context.Context, endpoint string, data url.Values, authentication ClientAuthentication, headers http.Header) (*Response, error) {
+	if headers == nil {
+		headers = defaultHeader()
+	}
+	client := oauth2.NewClient(ctx, nil)
 	authentication.InjectAuthentication(data, headers)
 	encodedData := data.Encode()
 
 	req, err := http.NewRequest("POST", endpoint, strings.NewReader(encodedData))
 	if err != nil {
 		return nil, fmt.Errorf("oauth2/google: failed to properly build http request: %v", err)
-
 	}
 	req = req.WithContext(ctx)
 	for key, list := range headers {
@@ -71,7 +89,7 @@ func exchangeToken(ctx context.Context, endpoint string, request *stsTokenExchan
 	if c := resp.StatusCode; c < 200 || c > 299 {
 		return nil, fmt.Errorf("oauth2/google: status code %d: %s", c, body)
 	}
-	var stsResp stsTokenExchangeResponse
+	var stsResp Response
 	err = json.Unmarshal(body, &stsResp)
 	if err != nil {
 		return nil, fmt.Errorf("oauth2/google: failed to unmarshal response body from Secure Token Server: %v", err)
@@ -81,8 +99,8 @@ func exchangeToken(ctx context.Context, endpoint string, request *stsTokenExchan
 	return &stsResp, nil
 }
 
-// stsTokenExchangeRequest contains fields necessary to make an oauth2 token exchange.
-type stsTokenExchangeRequest struct {
+// TokenExchangeRequest contains fields necessary to make an oauth2 token exchange.
+type TokenExchangeRequest struct {
 	ActingParty struct {
 		ActorToken     string
 		ActorTokenType string
@@ -96,8 +114,8 @@ type stsTokenExchangeRequest struct {
 	SubjectTokenType   string
 }
 
-// stsTokenExchangeResponse is used to decode the remote server response during an oauth2 token exchange.
-type stsTokenExchangeResponse struct {
+// Response is used to decode the remote server response during an oauth2 token exchange.
+type Response struct {
 	AccessToken     string `json:"access_token"`
 	IssuedTokenType string `json:"issued_token_type"`
 	TokenType       string `json:"token_type"`
diff --git a/vendor/golang.org/x/oauth2/oauth2.go b/vendor/golang.org/x/oauth2/oauth2.go
index cc7c98c25..90a2c3d6d 100644
--- a/vendor/golang.org/x/oauth2/oauth2.go
+++ b/vendor/golang.org/x/oauth2/oauth2.go
@@ -75,8 +75,9 @@ type TokenSource interface {
 // Endpoint represents an OAuth 2.0 provider's authorization and token
 // endpoint URLs.
 type Endpoint struct {
-	AuthURL  string
-	TokenURL string
+	AuthURL       string
+	DeviceAuthURL string
+	TokenURL      string
 
 	// AuthStyle optionally specifies how the endpoint wants the
 	// client ID & client secret sent. The zero value means to
@@ -143,15 +144,19 @@ func SetAuthURLParam(key, value string) AuthCodeOption {
 // AuthCodeURL returns a URL to OAuth 2.0 provider's consent page
 // that asks for permissions for the required scopes explicitly.
 //
-// State is a token to protect the user from CSRF attacks. You must
-// always provide a non-empty string and validate that it matches the
-// state query parameter on your redirect callback.
-// See http://tools.ietf.org/html/rfc6749#section-10.12 for more info.
+// State is an opaque value used by the client to maintain state between the
+// request and callback. The authorization server includes this value when
+// redirecting the user agent back to the client.
 //
 // Opts may include AccessTypeOnline or AccessTypeOffline, as well
 // as ApprovalForce.
-// It can also be used to pass the PKCE challenge.
-// See https://www.oauth.com/oauth2-servers/pkce/ for more info.
+//
+// To protect against CSRF attacks, opts should include a PKCE challenge
+// (S256ChallengeOption). Not all servers support PKCE. An alternative is to
+// generate a random state parameter and verify it after exchange.
+// See https://datatracker.ietf.org/doc/html/rfc6749#section-10.12 (predating
+// PKCE), https://www.oauth.com/oauth2-servers/pkce/ and
+// https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-09.html#name-cross-site-request-forgery (describing both approaches)
 func (c *Config) AuthCodeURL(state string, opts ...AuthCodeOption) string {
 	var buf bytes.Buffer
 	buf.WriteString(c.Endpoint.AuthURL)
@@ -166,7 +171,6 @@ func (c *Config) AuthCodeURL(state string, opts ...AuthCodeOption) string {
 		v.Set("scope", strings.Join(c.Scopes, " "))
 	}
 	if state != "" {
-		// TODO(light): Docs say never to omit state; don't allow empty.
 		v.Set("state", state)
 	}
 	for _, opt := range opts {
@@ -211,10 +215,11 @@ func (c *Config) PasswordCredentialsToken(ctx context.Context, username, passwor
 // The provided context optionally controls which HTTP client is used. See the HTTPClient variable.
 //
 // The code will be in the *http.Request.FormValue("code"). Before
-// calling Exchange, be sure to validate FormValue("state").
+// calling Exchange, be sure to validate FormValue("state") if you are
+// using it to protect against CSRF attacks.
 //
-// Opts may include the PKCE verifier code if previously used in AuthCodeURL.
-// See https://www.oauth.com/oauth2-servers/pkce/ for more info.
+// If using PKCE to protect against CSRF attacks, opts should include a
+// VerifierOption.
 func (c *Config) Exchange(ctx context.Context, code string, opts ...AuthCodeOption) (*Token, error) {
 	v := url.Values{
 		"grant_type": {"authorization_code"},
diff --git a/vendor/golang.org/x/oauth2/pkce.go b/vendor/golang.org/x/oauth2/pkce.go
new file mode 100644
index 000000000..50593b6df
--- /dev/null
+++ b/vendor/golang.org/x/oauth2/pkce.go
@@ -0,0 +1,68 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+package oauth2
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"net/url"
+)
+
+const (
+	codeChallengeKey       = "code_challenge"
+	codeChallengeMethodKey = "code_challenge_method"
+	codeVerifierKey        = "code_verifier"
+)
+
+// GenerateVerifier generates a PKCE code verifier with 32 octets of randomness.
+// This follows recommendations in RFC 7636.
+//
+// A fresh verifier should be generated for each authorization.
+// S256ChallengeOption(verifier) should then be passed to Config.AuthCodeURL
+// (or Config.DeviceAccess) and VerifierOption(verifier) to Config.Exchange
+// (or Config.DeviceAccessToken).
+func GenerateVerifier() string {
+	// "RECOMMENDED that the output of a suitable random number generator be
+	// used to create a 32-octet sequence.  The octet sequence is then
+	// base64url-encoded to produce a 43-octet URL-safe string to use as the
+	// code verifier."
+	// https://datatracker.ietf.org/doc/html/rfc7636#section-4.1
+	data := make([]byte, 32)
+	if _, err := rand.Read(data); err != nil {
+		panic(err)
+	}
+	return base64.RawURLEncoding.EncodeToString(data)
+}
+
+// VerifierOption returns a PKCE code verifier AuthCodeOption. It should be
+// passed to Config.Exchange or Config.DeviceAccessToken only.
+func VerifierOption(verifier string) AuthCodeOption {
+	return setParam{k: codeVerifierKey, v: verifier}
+}
+
+// S256ChallengeFromVerifier returns a PKCE code challenge derived from verifier with method S256.
+//
+// Prefer to use S256ChallengeOption where possible.
+func S256ChallengeFromVerifier(verifier string) string {
+	sha := sha256.Sum256([]byte(verifier))
+	return base64.RawURLEncoding.EncodeToString(sha[:])
+}
+
+// S256ChallengeOption derives a PKCE code challenge derived from verifier with
+// method S256. It should be passed to Config.AuthCodeURL or Config.DeviceAccess
+// only.
+func S256ChallengeOption(verifier string) AuthCodeOption {
+	return challengeOption{
+		challenge_method: "S256",
+		challenge:        S256ChallengeFromVerifier(verifier),
+	}
+}
+
+type challengeOption struct{ challenge_method, challenge string }
+
+func (p challengeOption) setValue(m url.Values) {
+	m.Set(codeChallengeMethodKey, p.challenge_method)
+	m.Set(codeChallengeKey, p.challenge)
+}
diff --git a/vendor/golang.org/x/sys/cpu/cpu_riscv64.go b/vendor/golang.org/x/sys/cpu/cpu_riscv64.go
index bd6c128af..ff7da60eb 100644
--- a/vendor/golang.org/x/sys/cpu/cpu_riscv64.go
+++ b/vendor/golang.org/x/sys/cpu/cpu_riscv64.go
@@ -7,6 +7,6 @@
 
 package cpu
 
-const cacheLineSize = 32
+const cacheLineSize = 64
 
 func initOptions() {}
diff --git a/vendor/golang.org/x/sys/cpu/hwcap_linux.go b/vendor/golang.org/x/sys/cpu/hwcap_linux.go
index 1d9d91f3e..34e49f955 100644
--- a/vendor/golang.org/x/sys/cpu/hwcap_linux.go
+++ b/vendor/golang.org/x/sys/cpu/hwcap_linux.go
@@ -5,7 +5,7 @@
 package cpu
 
 import (
-	"io/ioutil"
+	"os"
 )
 
 const (
@@ -39,7 +39,7 @@ func readHWCAP() error {
 		return nil
 	}
 
-	buf, err := ioutil.ReadFile(procAuxv)
+	buf, err := os.ReadFile(procAuxv)
 	if err != nil {
 		// e.g. on android /proc/self/auxv is not accessible, so silently
 		// ignore the error and leave Initialized = false. On some
diff --git a/vendor/golang.org/x/sys/internal/unsafeheader/unsafeheader.go b/vendor/golang.org/x/sys/internal/unsafeheader/unsafeheader.go
deleted file mode 100644
index e07899b90..000000000
--- a/vendor/golang.org/x/sys/internal/unsafeheader/unsafeheader.go
+++ /dev/null
@@ -1,30 +0,0 @@
-// Copyright 2020 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-// Package unsafeheader contains header declarations for the Go runtime's
-// slice and string implementations.
-//
-// This package allows x/sys to use types equivalent to
-// reflect.SliceHeader and reflect.StringHeader without introducing
-// a dependency on the (relatively heavy) "reflect" package.
-package unsafeheader
-
-import (
-	"unsafe"
-)
-
-// Slice is the runtime representation of a slice.
-// It cannot be used safely or portably and its representation may change in a later release.
-type Slice struct {
-	Data unsafe.Pointer
-	Len  int
-	Cap  int
-}
-
-// String is the runtime representation of a string.
-// It cannot be used safely or portably and its representation may change in a later release.
-type String struct {
-	Data unsafe.Pointer
-	Len  int
-}
diff --git a/vendor/golang.org/x/sys/unix/ptrace_darwin.go b/vendor/golang.org/x/sys/unix/ptrace_darwin.go
index 39dba6ca6..463c3eff7 100644
--- a/vendor/golang.org/x/sys/unix/ptrace_darwin.go
+++ b/vendor/golang.org/x/sys/unix/ptrace_darwin.go
@@ -7,12 +7,6 @@
 
 package unix
 
-import "unsafe"
-
 func ptrace(request int, pid int, addr uintptr, data uintptr) error {
 	return ptrace1(request, pid, addr, data)
 }
-
-func ptracePtr(request int, pid int, addr uintptr, data unsafe.Pointer) error {
-	return ptrace1Ptr(request, pid, addr, data)
-}
diff --git a/vendor/golang.org/x/sys/unix/ptrace_ios.go b/vendor/golang.org/x/sys/unix/ptrace_ios.go
index 9ea66330a..ed0509a01 100644
--- a/vendor/golang.org/x/sys/unix/ptrace_ios.go
+++ b/vendor/golang.org/x/sys/unix/ptrace_ios.go
@@ -7,12 +7,6 @@
 
 package unix
 
-import "unsafe"
-
 func ptrace(request int, pid int, addr uintptr, data uintptr) (err error) {
 	return ENOTSUP
 }
-
-func ptracePtr(request int, pid int, addr uintptr, data unsafe.Pointer) (err error) {
-	return ENOTSUP
-}
diff --git a/vendor/golang.org/x/sys/unix/syscall_aix.go b/vendor/golang.org/x/sys/unix/syscall_aix.go
index 9a6e5acac..e94e6cdac 100644
--- a/vendor/golang.org/x/sys/unix/syscall_aix.go
+++ b/vendor/golang.org/x/sys/unix/syscall_aix.go
@@ -487,8 +487,6 @@ func Fsync(fd int) error {
 //sys	Unlinkat(dirfd int, path string, flags int) (err error)
 //sys	Ustat(dev int, ubuf *Ustat_t) (err error)
 //sys	write(fd int, p []byte) (n int, err error)
-//sys	readlen(fd int, p *byte, np int) (n int, err error) = read
-//sys	writelen(fd int, p *byte, np int) (n int, err error) = write
 
 //sys	Dup2(oldfd int, newfd int) (err error)
 //sys	Fadvise(fd int, offset int64, length int64, advice int) (err error) = posix_fadvise64
diff --git a/vendor/golang.org/x/sys/unix/syscall_darwin.go b/vendor/golang.org/x/sys/unix/syscall_darwin.go
index 135cc3cd7..59542a897 100644
--- a/vendor/golang.org/x/sys/unix/syscall_darwin.go
+++ b/vendor/golang.org/x/sys/unix/syscall_darwin.go
@@ -644,189 +644,3 @@ func SysctlKinfoProcSlice(name string, args ...int) ([]KinfoProc, error) {
 //sys	write(fd int, p []byte) (n int, err error)
 //sys	mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (ret uintptr, err error)
 //sys	munmap(addr uintptr, length uintptr) (err error)
-//sys	readlen(fd int, buf *byte, nbuf int) (n int, err error) = SYS_READ
-//sys	writelen(fd int, buf *byte, nbuf int) (n int, err error) = SYS_WRITE
-
-/*
- * Unimplemented
- */
-// Profil
-// Sigaction
-// Sigprocmask
-// Getlogin
-// Sigpending
-// Sigaltstack
-// Ioctl
-// Reboot
-// Execve
-// Vfork
-// Sbrk
-// Sstk
-// Ovadvise
-// Mincore
-// Setitimer
-// Swapon
-// Select
-// Sigsuspend
-// Readv
-// Writev
-// Nfssvc
-// Getfh
-// Quotactl
-// Csops
-// Waitid
-// Add_profil
-// Kdebug_trace
-// Sigreturn
-// Atsocket
-// Kqueue_from_portset_np
-// Kqueue_portset
-// Getattrlist
-// Getdirentriesattr
-// Searchfs
-// Delete
-// Copyfile
-// Watchevent
-// Waitevent
-// Modwatch
-// Fsctl
-// Initgroups
-// Posix_spawn
-// Nfsclnt
-// Fhopen
-// Minherit
-// Semsys
-// Msgsys
-// Shmsys
-// Semctl
-// Semget
-// Semop
-// Msgctl
-// Msgget
-// Msgsnd
-// Msgrcv
-// Shm_open
-// Shm_unlink
-// Sem_open
-// Sem_close
-// Sem_unlink
-// Sem_wait
-// Sem_trywait
-// Sem_post
-// Sem_getvalue
-// Sem_init
-// Sem_destroy
-// Open_extended
-// Umask_extended
-// Stat_extended
-// Lstat_extended
-// Fstat_extended
-// Chmod_extended
-// Fchmod_extended
-// Access_extended
-// Settid
-// Gettid
-// Setsgroups
-// Getsgroups
-// Setwgroups
-// Getwgroups
-// Mkfifo_extended
-// Mkdir_extended
-// Identitysvc
-// Shared_region_check_np
-// Shared_region_map_np
-// __pthread_mutex_destroy
-// __pthread_mutex_init
-// __pthread_mutex_lock
-// __pthread_mutex_trylock
-// __pthread_mutex_unlock
-// __pthread_cond_init
-// __pthread_cond_destroy
-// __pthread_cond_broadcast
-// __pthread_cond_signal
-// Setsid_with_pid
-// __pthread_cond_timedwait
-// Aio_fsync
-// Aio_return
-// Aio_suspend
-// Aio_cancel
-// Aio_error
-// Aio_read
-// Aio_write
-// Lio_listio
-// __pthread_cond_wait
-// Iopolicysys
-// __pthread_kill
-// __pthread_sigmask
-// __sigwait
-// __disable_threadsignal
-// __pthread_markcancel
-// __pthread_canceled
-// __semwait_signal
-// Proc_info
-// sendfile
-// Stat64_extended
-// Lstat64_extended
-// Fstat64_extended
-// __pthread_chdir
-// __pthread_fchdir
-// Audit
-// Auditon
-// Getauid
-// Setauid
-// Getaudit
-// Setaudit
-// Getaudit_addr
-// Setaudit_addr
-// Auditctl
-// Bsdthread_create
-// Bsdthread_terminate
-// Stack_snapshot
-// Bsdthread_register
-// Workq_open
-// Workq_ops
-// __mac_execve
-// __mac_syscall
-// __mac_get_file
-// __mac_set_file
-// __mac_get_link
-// __mac_set_link
-// __mac_get_proc
-// __mac_set_proc
-// __mac_get_fd
-// __mac_set_fd
-// __mac_get_pid
-// __mac_get_lcid
-// __mac_get_lctx
-// __mac_set_lctx
-// Setlcid
-// Read_nocancel
-// Write_nocancel
-// Open_nocancel
-// Close_nocancel
-// Wait4_nocancel
-// Recvmsg_nocancel
-// Sendmsg_nocancel
-// Recvfrom_nocancel
-// Accept_nocancel
-// Fcntl_nocancel
-// Select_nocancel
-// Fsync_nocancel
-// Connect_nocancel
-// Sigsuspend_nocancel
-// Readv_nocancel
-// Writev_nocancel
-// Sendto_nocancel
-// Pread_nocancel
-// Pwrite_nocancel
-// Waitid_nocancel
-// Poll_nocancel
-// Msgsnd_nocancel
-// Msgrcv_nocancel
-// Sem_wait_nocancel
-// Aio_suspend_nocancel
-// __sigwait_nocancel
-// __semwait_signal_nocancel
-// __mac_mount
-// __mac_get_mount
-// __mac_getfsstat
diff --git a/vendor/golang.org/x/sys/unix/syscall_darwin_amd64.go b/vendor/golang.org/x/sys/unix/syscall_darwin_amd64.go
index 9fa879806..b37310ce9 100644
--- a/vendor/golang.org/x/sys/unix/syscall_darwin_amd64.go
+++ b/vendor/golang.org/x/sys/unix/syscall_darwin_amd64.go
@@ -47,6 +47,5 @@ func Syscall9(num, a1, a2, a3, a4, a5, a6, a7, a8, a9 uintptr) (r1, r2 uintptr,
 //sys	getfsstat(buf unsafe.Pointer, size uintptr, flags int) (n int, err error) = SYS_GETFSSTAT64
 //sys	Lstat(path string, stat *Stat_t) (err error) = SYS_LSTAT64
 //sys	ptrace1(request int, pid int, addr uintptr, data uintptr) (err error) = SYS_ptrace
-//sys	ptrace1Ptr(request int, pid int, addr unsafe.Pointer, data uintptr) (err error) = SYS_ptrace
 //sys	Stat(path string, stat *Stat_t) (err error) = SYS_STAT64
 //sys	Statfs(path string, stat *Statfs_t) (err error) = SYS_STATFS64
diff --git a/vendor/golang.org/x/sys/unix/syscall_darwin_arm64.go b/vendor/golang.org/x/sys/unix/syscall_darwin_arm64.go
index f17b8c526..d51ec9963 100644
--- a/vendor/golang.org/x/sys/unix/syscall_darwin_arm64.go
+++ b/vendor/golang.org/x/sys/unix/syscall_darwin_arm64.go
@@ -47,6 +47,5 @@ func Syscall9(num, a1, a2, a3, a4, a5, a6, a7, a8, a9 uintptr) (r1, r2 uintptr,
 //sys	getfsstat(buf unsafe.Pointer, size uintptr, flags int) (n int, err error) = SYS_GETFSSTAT
 //sys	Lstat(path string, stat *Stat_t) (err error)
 //sys	ptrace1(request int, pid int, addr uintptr, data uintptr) (err error) = SYS_ptrace
-//sys	ptrace1Ptr(request int, pid int, addr unsafe.Pointer, data uintptr) (err error) = SYS_ptrace
 //sys	Stat(path string, stat *Stat_t) (err error)
 //sys	Statfs(path string, stat *Statfs_t) (err error)
diff --git a/vendor/golang.org/x/sys/unix/syscall_dragonfly.go b/vendor/golang.org/x/sys/unix/syscall_dragonfly.go
index d4ce988e7..97cb916f2 100644
--- a/vendor/golang.org/x/sys/unix/syscall_dragonfly.go
+++ b/vendor/golang.org/x/sys/unix/syscall_dragonfly.go
@@ -343,203 +343,5 @@ func Sendfile(outfd int, infd int, offset *int64, count int) (written int, err e
 //sys	write(fd int, p []byte) (n int, err error)
 //sys	mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (ret uintptr, err error)
 //sys	munmap(addr uintptr, length uintptr) (err error)
-//sys	readlen(fd int, buf *byte, nbuf int) (n int, err error) = SYS_READ
-//sys	writelen(fd int, buf *byte, nbuf int) (n int, err error) = SYS_WRITE
 //sys	accept4(fd int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (nfd int, err error)
 //sys	utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error)
-
-/*
- * Unimplemented
- * TODO(jsing): Update this list for DragonFly.
- */
-// Profil
-// Sigaction
-// Sigprocmask
-// Getlogin
-// Sigpending
-// Sigaltstack
-// Reboot
-// Execve
-// Vfork
-// Sbrk
-// Sstk
-// Ovadvise
-// Mincore
-// Setitimer
-// Swapon
-// Select
-// Sigsuspend
-// Readv
-// Writev
-// Nfssvc
-// Getfh
-// Quotactl
-// Mount
-// Csops
-// Waitid
-// Add_profil
-// Kdebug_trace
-// Sigreturn
-// Atsocket
-// Kqueue_from_portset_np
-// Kqueue_portset
-// Getattrlist
-// Setattrlist
-// Getdirentriesattr
-// Searchfs
-// Delete
-// Copyfile
-// Watchevent
-// Waitevent
-// Modwatch
-// Getxattr
-// Fgetxattr
-// Setxattr
-// Fsetxattr
-// Removexattr
-// Fremovexattr
-// Listxattr
-// Flistxattr
-// Fsctl
-// Initgroups
-// Posix_spawn
-// Nfsclnt
-// Fhopen
-// Minherit
-// Semsys
-// Msgsys
-// Shmsys
-// Semctl
-// Semget
-// Semop
-// Msgctl
-// Msgget
-// Msgsnd
-// Msgrcv
-// Shmat
-// Shmctl
-// Shmdt
-// Shmget
-// Shm_open
-// Shm_unlink
-// Sem_open
-// Sem_close
-// Sem_unlink
-// Sem_wait
-// Sem_trywait
-// Sem_post
-// Sem_getvalue
-// Sem_init
-// Sem_destroy
-// Open_extended
-// Umask_extended
-// Stat_extended
-// Lstat_extended
-// Fstat_extended
-// Chmod_extended
-// Fchmod_extended
-// Access_extended
-// Settid
-// Gettid
-// Setsgroups
-// Getsgroups
-// Setwgroups
-// Getwgroups
-// Mkfifo_extended
-// Mkdir_extended
-// Identitysvc
-// Shared_region_check_np
-// Shared_region_map_np
-// __pthread_mutex_destroy
-// __pthread_mutex_init
-// __pthread_mutex_lock
-// __pthread_mutex_trylock
-// __pthread_mutex_unlock
-// __pthread_cond_init
-// __pthread_cond_destroy
-// __pthread_cond_broadcast
-// __pthread_cond_signal
-// Setsid_with_pid
-// __pthread_cond_timedwait
-// Aio_fsync
-// Aio_return
-// Aio_suspend
-// Aio_cancel
-// Aio_error
-// Aio_read
-// Aio_write
-// Lio_listio
-// __pthread_cond_wait
-// Iopolicysys
-// __pthread_kill
-// __pthread_sigmask
-// __sigwait
-// __disable_threadsignal
-// __pthread_markcancel
-// __pthread_canceled
-// __semwait_signal
-// Proc_info
-// Stat64_extended
-// Lstat64_extended
-// Fstat64_extended
-// __pthread_chdir
-// __pthread_fchdir
-// Audit
-// Auditon
-// Getauid
-// Setauid
-// Getaudit
-// Setaudit
-// Getaudit_addr
-// Setaudit_addr
-// Auditctl
-// Bsdthread_create
-// Bsdthread_terminate
-// Stack_snapshot
-// Bsdthread_register
-// Workq_open
-// Workq_ops
-// __mac_execve
-// __mac_syscall
-// __mac_get_file
-// __mac_set_file
-// __mac_get_link
-// __mac_set_link
-// __mac_get_proc
-// __mac_set_proc
-// __mac_get_fd
-// __mac_set_fd
-// __mac_get_pid
-// __mac_get_lcid
-// __mac_get_lctx
-// __mac_set_lctx
-// Setlcid
-// Read_nocancel
-// Write_nocancel
-// Open_nocancel
-// Close_nocancel
-// Wait4_nocancel
-// Recvmsg_nocancel
-// Sendmsg_nocancel
-// Recvfrom_nocancel
-// Accept_nocancel
-// Fcntl_nocancel
-// Select_nocancel
-// Fsync_nocancel
-// Connect_nocancel
-// Sigsuspend_nocancel
-// Readv_nocancel
-// Writev_nocancel
-// Sendto_nocancel
-// Pread_nocancel
-// Pwrite_nocancel
-// Waitid_nocancel
-// Msgsnd_nocancel
-// Msgrcv_nocancel
-// Sem_wait_nocancel
-// Aio_suspend_nocancel
-// __sigwait_nocancel
-// __semwait_signal_nocancel
-// __mac_mount
-// __mac_get_mount
-// __mac_getfsstat
diff --git a/vendor/golang.org/x/sys/unix/syscall_freebsd.go b/vendor/golang.org/x/sys/unix/syscall_freebsd.go
index afb10106f..64d1bb4db 100644
--- a/vendor/golang.org/x/sys/unix/syscall_freebsd.go
+++ b/vendor/golang.org/x/sys/unix/syscall_freebsd.go
@@ -449,197 +449,5 @@ func Dup3(oldfd, newfd, flags int) error {
 //sys	write(fd int, p []byte) (n int, err error)
 //sys	mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (ret uintptr, err error)
 //sys	munmap(addr uintptr, length uintptr) (err error)
-//sys	readlen(fd int, buf *byte, nbuf int) (n int, err error) = SYS_READ
-//sys	writelen(fd int, buf *byte, nbuf int) (n int, err error) = SYS_WRITE
 //sys	accept4(fd int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (nfd int, err error)
 //sys	utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error)
-
-/*
- * Unimplemented
- */
-// Profil
-// Sigaction
-// Sigprocmask
-// Getlogin
-// Sigpending
-// Sigaltstack
-// Ioctl
-// Reboot
-// Execve
-// Vfork
-// Sbrk
-// Sstk
-// Ovadvise
-// Mincore
-// Setitimer
-// Swapon
-// Select
-// Sigsuspend
-// Readv
-// Writev
-// Nfssvc
-// Getfh
-// Quotactl
-// Mount
-// Csops
-// Waitid
-// Add_profil
-// Kdebug_trace
-// Sigreturn
-// Atsocket
-// Kqueue_from_portset_np
-// Kqueue_portset
-// Getattrlist
-// Setattrlist
-// Getdents
-// Getdirentriesattr
-// Searchfs
-// Delete
-// Copyfile
-// Watchevent
-// Waitevent
-// Modwatch
-// Fsctl
-// Initgroups
-// Posix_spawn
-// Nfsclnt
-// Fhopen
-// Minherit
-// Semsys
-// Msgsys
-// Shmsys
-// Semctl
-// Semget
-// Semop
-// Msgctl
-// Msgget
-// Msgsnd
-// Msgrcv
-// Shmat
-// Shmctl
-// Shmdt
-// Shmget
-// Shm_open
-// Shm_unlink
-// Sem_open
-// Sem_close
-// Sem_unlink
-// Sem_wait
-// Sem_trywait
-// Sem_post
-// Sem_getvalue
-// Sem_init
-// Sem_destroy
-// Open_extended
-// Umask_extended
-// Stat_extended
-// Lstat_extended
-// Fstat_extended
-// Chmod_extended
-// Fchmod_extended
-// Access_extended
-// Settid
-// Gettid
-// Setsgroups
-// Getsgroups
-// Setwgroups
-// Getwgroups
-// Mkfifo_extended
-// Mkdir_extended
-// Identitysvc
-// Shared_region_check_np
-// Shared_region_map_np
-// __pthread_mutex_destroy
-// __pthread_mutex_init
-// __pthread_mutex_lock
-// __pthread_mutex_trylock
-// __pthread_mutex_unlock
-// __pthread_cond_init
-// __pthread_cond_destroy
-// __pthread_cond_broadcast
-// __pthread_cond_signal
-// Setsid_with_pid
-// __pthread_cond_timedwait
-// Aio_fsync
-// Aio_return
-// Aio_suspend
-// Aio_cancel
-// Aio_error
-// Aio_read
-// Aio_write
-// Lio_listio
-// __pthread_cond_wait
-// Iopolicysys
-// __pthread_kill
-// __pthread_sigmask
-// __sigwait
-// __disable_threadsignal
-// __pthread_markcancel
-// __pthread_canceled
-// __semwait_signal
-// Proc_info
-// Stat64_extended
-// Lstat64_extended
-// Fstat64_extended
-// __pthread_chdir
-// __pthread_fchdir
-// Audit
-// Auditon
-// Getauid
-// Setauid
-// Getaudit
-// Setaudit
-// Getaudit_addr
-// Setaudit_addr
-// Auditctl
-// Bsdthread_create
-// Bsdthread_terminate
-// Stack_snapshot
-// Bsdthread_register
-// Workq_open
-// Workq_ops
-// __mac_execve
-// __mac_syscall
-// __mac_get_file
-// __mac_set_file
-// __mac_get_link
-// __mac_set_link
-// __mac_get_proc
-// __mac_set_proc
-// __mac_get_fd
-// __mac_set_fd
-// __mac_get_pid
-// __mac_get_lcid
-// __mac_get_lctx
-// __mac_set_lctx
-// Setlcid
-// Read_nocancel
-// Write_nocancel
-// Open_nocancel
-// Close_nocancel
-// Wait4_nocancel
-// Recvmsg_nocancel
-// Sendmsg_nocancel
-// Recvfrom_nocancel
-// Accept_nocancel
-// Fcntl_nocancel
-// Select_nocancel
-// Fsync_nocancel
-// Connect_nocancel
-// Sigsuspend_nocancel
-// Readv_nocancel
-// Writev_nocancel
-// Sendto_nocancel
-// Pread_nocancel
-// Pwrite_nocancel
-// Waitid_nocancel
-// Poll_nocancel
-// Msgsnd_nocancel
-// Msgrcv_nocancel
-// Sem_wait_nocancel
-// Aio_suspend_nocancel
-// __sigwait_nocancel
-// __semwait_signal_nocancel
-// __mac_mount
-// __mac_get_mount
-// __mac_getfsstat
diff --git a/vendor/golang.org/x/sys/unix/syscall_linux.go b/vendor/golang.org/x/sys/unix/syscall_linux.go
index 0ba030197..fb4e50224 100644
--- a/vendor/golang.org/x/sys/unix/syscall_linux.go
+++ b/vendor/golang.org/x/sys/unix/syscall_linux.go
@@ -693,10 +693,10 @@ type SockaddrALG struct {
 
 func (sa *SockaddrALG) sockaddr() (unsafe.Pointer, _Socklen, error) {
 	// Leave room for NUL byte terminator.
-	if len(sa.Type) > 13 {
+	if len(sa.Type) > len(sa.raw.Type)-1 {
 		return nil, 0, EINVAL
 	}
-	if len(sa.Name) > 63 {
+	if len(sa.Name) > len(sa.raw.Name)-1 {
 		return nil, 0, EINVAL
 	}
 
@@ -704,17 +704,8 @@ func (sa *SockaddrALG) sockaddr() (unsafe.Pointer, _Socklen, error) {
 	sa.raw.Feat = sa.Feature
 	sa.raw.Mask = sa.Mask
 
-	typ, err := ByteSliceFromString(sa.Type)
-	if err != nil {
-		return nil, 0, err
-	}
-	name, err := ByteSliceFromString(sa.Name)
-	if err != nil {
-		return nil, 0, err
-	}
-
-	copy(sa.raw.Type[:], typ)
-	copy(sa.raw.Name[:], name)
+	copy(sa.raw.Type[:], sa.Type)
+	copy(sa.raw.Name[:], sa.Name)
 
 	return unsafe.Pointer(&sa.raw), SizeofSockaddrALG, nil
 }
@@ -1988,8 +1979,6 @@ func Signalfd(fd int, sigmask *Sigset_t, flags int) (newfd int, err error) {
 //sys	Unshare(flags int) (err error)
 //sys	write(fd int, p []byte) (n int, err error)
 //sys	exitThread(code int) (err error) = SYS_EXIT
-//sys	readlen(fd int, p *byte, np int) (n int, err error) = SYS_READ
-//sys	writelen(fd int, p *byte, np int) (n int, err error) = SYS_WRITE
 //sys	readv(fd int, iovs []Iovec) (n int, err error) = SYS_READV
 //sys	writev(fd int, iovs []Iovec) (n int, err error) = SYS_WRITEV
 //sys	preadv(fd int, iovs []Iovec, offs_l uintptr, offs_h uintptr) (n int, err error) = SYS_PREADV
@@ -2493,99 +2482,3 @@ func SchedGetAttr(pid int, flags uint) (*SchedAttr, error) {
 	}
 	return attr, nil
 }
-
-/*
- * Unimplemented
- */
-// AfsSyscall
-// ArchPrctl
-// Brk
-// ClockNanosleep
-// ClockSettime
-// Clone
-// EpollCtlOld
-// EpollPwait
-// EpollWaitOld
-// Execve
-// Fork
-// Futex
-// GetKernelSyms
-// GetMempolicy
-// GetRobustList
-// GetThreadArea
-// Getpmsg
-// IoCancel
-// IoDestroy
-// IoGetevents
-// IoSetup
-// IoSubmit
-// IoprioGet
-// IoprioSet
-// KexecLoad
-// LookupDcookie
-// Mbind
-// MigratePages
-// Mincore
-// ModifyLdt
-// Mount
-// MovePages
-// MqGetsetattr
-// MqNotify
-// MqOpen
-// MqTimedreceive
-// MqTimedsend
-// MqUnlink
-// Msgctl
-// Msgget
-// Msgrcv
-// Msgsnd
-// Nfsservctl
-// Personality
-// Pselect6
-// Ptrace
-// Putpmsg
-// Quotactl
-// Readahead
-// Readv
-// RemapFilePages
-// RestartSyscall
-// RtSigaction
-// RtSigpending
-// RtSigqueueinfo
-// RtSigreturn
-// RtSigsuspend
-// RtSigtimedwait
-// SchedGetPriorityMax
-// SchedGetPriorityMin
-// SchedGetparam
-// SchedGetscheduler
-// SchedRrGetInterval
-// SchedSetparam
-// SchedYield
-// Security
-// Semctl
-// Semget
-// Semop
-// Semtimedop
-// SetMempolicy
-// SetRobustList
-// SetThreadArea
-// SetTidAddress
-// Sigaltstack
-// Swapoff
-// Swapon
-// Sysfs
-// TimerCreate
-// TimerDelete
-// TimerGetoverrun
-// TimerGettime
-// TimerSettime
-// Tkill (obsolete)
-// Tuxcall
-// Umount2
-// Uselib
-// Utimensat
-// Vfork
-// Vhangup
-// Vserver
-// _Sysctl
diff --git a/vendor/golang.org/x/sys/unix/syscall_netbsd.go b/vendor/golang.org/x/sys/unix/syscall_netbsd.go
index ddd1ac853..88162099a 100644
--- a/vendor/golang.org/x/sys/unix/syscall_netbsd.go
+++ b/vendor/golang.org/x/sys/unix/syscall_netbsd.go
@@ -356,8 +356,6 @@ func Statvfs(path string, buf *Statvfs_t) (err error) {
 //sys	write(fd int, p []byte) (n int, err error)
 //sys	mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (ret uintptr, err error)
 //sys	munmap(addr uintptr, length uintptr) (err error)
-//sys	readlen(fd int, buf *byte, nbuf int) (n int, err error) = SYS_READ
-//sys	writelen(fd int, buf *byte, nbuf int) (n int, err error) = SYS_WRITE
 //sys	utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error)
 
 const (
@@ -371,262 +369,3 @@ const (
 func mremap(oldaddr uintptr, oldlength uintptr, newlength uintptr, flags int, newaddr uintptr) (uintptr, error) {
 	return mremapNetBSD(oldaddr, oldlength, newaddr, newlength, flags)
 }
-
-/*
- * Unimplemented
- */
-// ____semctl13
-// __clone
-// __fhopen40
-// __fhstat40
-// __fhstatvfs140
-// __fstat30
-// __getcwd
-// __getfh30
-// __getlogin
-// __lstat30
-// __mount50
-// __msgctl13
-// __msync13
-// __ntp_gettime30
-// __posix_chown
-// __posix_fchown
-// __posix_lchown
-// __posix_rename
-// __setlogin
-// __shmctl13
-// __sigaction_sigtramp
-// __sigaltstack14
-// __sigpending14
-// __sigprocmask14
-// __sigsuspend14
-// __sigtimedwait
-// __stat30
-// __syscall
-// __vfork14
-// _ksem_close
-// _ksem_destroy
-// _ksem_getvalue
-// _ksem_init
-// _ksem_open
-// _ksem_post
-// _ksem_trywait
-// _ksem_unlink
-// _ksem_wait
-// _lwp_continue
-// _lwp_create
-// _lwp_ctl
-// _lwp_detach
-// _lwp_exit
-// _lwp_getname
-// _lwp_getprivate
-// _lwp_kill
-// _lwp_park
-// _lwp_self
-// _lwp_setname
-// _lwp_setprivate
-// _lwp_suspend
-// _lwp_unpark
-// _lwp_unpark_all
-// _lwp_wait
-// _lwp_wakeup
-// _pset_bind
-// _sched_getaffinity
-// _sched_getparam
-// _sched_setaffinity
-// _sched_setparam
-// acct
-// aio_cancel
-// aio_error
-// aio_fsync
-// aio_read
-// aio_return
-// aio_suspend
-// aio_write
-// break
-// clock_getres
-// clock_gettime
-// clock_settime
-// compat_09_ogetdomainname
-// compat_09_osetdomainname
-// compat_09_ouname
-// compat_10_omsgsys
-// compat_10_osemsys
-// compat_10_oshmsys
-// compat_12_fstat12
-// compat_12_getdirentries
-// compat_12_lstat12
-// compat_12_msync
-// compat_12_oreboot
-// compat_12_oswapon
-// compat_12_stat12
-// compat_13_sigaction13
-// compat_13_sigaltstack13
-// compat_13_sigpending13
-// compat_13_sigprocmask13
-// compat_13_sigreturn13
-// compat_13_sigsuspend13
-// compat_14___semctl
-// compat_14_msgctl
-// compat_14_shmctl
-// compat_16___sigaction14
-// compat_16___sigreturn14
-// compat_20_fhstatfs
-// compat_20_fstatfs
-// compat_20_getfsstat
-// compat_20_statfs
-// compat_30___fhstat30
-// compat_30___fstat13
-// compat_30___lstat13
-// compat_30___stat13
-// compat_30_fhopen
-// compat_30_fhstat
-// compat_30_fhstatvfs1
-// compat_30_getdents
-// compat_30_getfh
-// compat_30_ntp_gettime
-// compat_30_socket
-// compat_40_mount
-// compat_43_fstat43
-// compat_43_lstat43
-// compat_43_oaccept
-// compat_43_ocreat
-// compat_43_oftruncate
-// compat_43_ogetdirentries
-// compat_43_ogetdtablesize
-// compat_43_ogethostid
-// compat_43_ogethostname
-// compat_43_ogetkerninfo
-// compat_43_ogetpagesize
-// compat_43_ogetpeername
-// compat_43_ogetrlimit
-// compat_43_ogetsockname
-// compat_43_okillpg
-// compat_43_olseek
-// compat_43_ommap
-// compat_43_oquota
-// compat_43_orecv
-// compat_43_orecvfrom
-// compat_43_orecvmsg
-// compat_43_osend
-// compat_43_osendmsg
-// compat_43_osethostid
-// compat_43_osethostname
-// compat_43_osigblock
-// compat_43_osigsetmask
-// compat_43_osigstack
-// compat_43_osigvec
-// compat_43_otruncate
-// compat_43_owait
-// compat_43_stat43
-// execve
-// extattr_delete_fd
-// extattr_delete_file
-// extattr_delete_link
-// extattr_get_fd
-// extattr_get_file
-// extattr_get_link
-// extattr_list_fd
-// extattr_list_file
-// extattr_list_link
-// extattr_set_fd
-// extattr_set_file
-// extattr_set_link
-// extattrctl
-// fchroot
-// fdatasync
-// fgetxattr
-// fktrace
-// flistxattr
-// fork
-// fremovexattr
-// fsetxattr
-// fstatvfs1
-// fsync_range
-// getcontext
-// getitimer
-// getvfsstat
-// getxattr
-// ktrace
-// lchflags
-// lchmod
-// lfs_bmapv
-// lfs_markv
-// lfs_segclean
-// lfs_segwait
-// lgetxattr
-// lio_listio
-// listxattr
-// llistxattr
-// lremovexattr
-// lseek
-// lsetxattr
-// lutimes
-// madvise
-// mincore
-// minherit
-// modctl
-// mq_close
-// mq_getattr
-// mq_notify
-// mq_open
-// mq_receive
-// mq_send
-// mq_setattr
-// mq_timedreceive
-// mq_timedsend
-// mq_unlink
-// msgget
-// msgrcv
-// msgsnd
-// nfssvc
-// ntp_adjtime
-// pmc_control
-// pmc_get_info
-// pollts
-// preadv
-// profil
-// pselect
-// pset_assign
-// pset_create
-// pset_destroy
-// ptrace
-// pwritev
-// quotactl
-// rasctl
-// readv
-// reboot
-// removexattr
-// sa_enable
-// sa_preempt
-// sa_register
-// sa_setconcurrency
-// sa_stacks
-// sa_yield
-// sbrk
-// sched_yield
-// semconfig
-// semget
-// semop
-// setcontext
-// setitimer
-// setxattr
-// shmat
-// shmdt
-// shmget
-// sstk
-// statvfs1
-// swapctl
-// sysarch
-// syscall
-// timer_create
-// timer_delete
-// timer_getoverrun
-// timer_gettime
-// timer_settime
-// undelete
-// utrace
-// uuidgen
-// vadvise
-// vfork
-// writev
diff --git a/vendor/golang.org/x/sys/unix/syscall_openbsd.go b/vendor/golang.org/x/sys/unix/syscall_openbsd.go
index c5f166a11..6f34479b5 100644
--- a/vendor/golang.org/x/sys/unix/syscall_openbsd.go
+++ b/vendor/golang.org/x/sys/unix/syscall_openbsd.go
@@ -326,78 +326,4 @@ func Uname(uname *Utsname) error {
 //sys	write(fd int, p []byte) (n int, err error)
 //sys	mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (ret uintptr, err error)
 //sys	munmap(addr uintptr, length uintptr) (err error)
-//sys	readlen(fd int, buf *byte, nbuf int) (n int, err error) = SYS_READ
-//sys	writelen(fd int, buf *byte, nbuf int) (n int, err error) = SYS_WRITE
 //sys	utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error)
-
-/*
- * Unimplemented
- */
-// __getcwd
-// __semctl
-// __syscall
-// __sysctl
-// adjfreq
-// break
-// clock_getres
-// clock_gettime
-// clock_settime
-// closefrom
-// execve
-// fhopen
-// fhstat
-// fhstatfs
-// fork
-// futimens
-// getfh
-// getgid
-// getitimer
-// getlogin
-// getthrid
-// ktrace
-// lfs_bmapv
-// lfs_markv
-// lfs_segclean
-// lfs_segwait
-// mincore
-// minherit
-// mount
-// mquery
-// msgctl
-// msgget
-// msgrcv
-// msgsnd
-// nfssvc
-// nnpfspioctl
-// preadv
-// profil
-// pwritev
-// quotactl
-// readv
-// reboot
-// renameat
-// rfork
-// sched_yield
-// semget
-// semop
-// setgroups
-// setitimer
-// setsockopt
-// shmat
-// shmctl
-// shmdt
-// shmget
-// sigaction
-// sigaltstack
-// sigpending
-// sigprocmask
-// sigreturn
-// sigsuspend
-// sysarch
-// syscall
-// threxit
-// thrsigdivert
-// thrsleep
-// thrwakeup
-// vfork
-// writev
diff --git a/vendor/golang.org/x/sys/unix/syscall_solaris.go b/vendor/golang.org/x/sys/unix/syscall_solaris.go
index 72d23575f..b99cfa134 100644
--- a/vendor/golang.org/x/sys/unix/syscall_solaris.go
+++ b/vendor/golang.org/x/sys/unix/syscall_solaris.go
@@ -698,24 +698,6 @@ func Sendfile(outfd int, infd int, offset *int64, count int) (written int, err e
 //sys	setsockopt(s int, level int, name int, val unsafe.Pointer, vallen uintptr) (err error) = libsocket.setsockopt
 //sys	recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Socklen) (n int, err error) = libsocket.recvfrom
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procread)), 3, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf), 0, 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = e1
-	}
-	return
-}
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procwrite)), 3, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf), 0, 0, 0)
-	n = int(r0)
-	if e1 != 0 {
-		err = e1
-	}
-	return
-}
-
 // Event Ports
 
 type fileObjCookie struct {
diff --git a/vendor/golang.org/x/sys/unix/syscall_zos_s390x.go b/vendor/golang.org/x/sys/unix/syscall_zos_s390x.go
index 44e72edb4..4596d041c 100644
--- a/vendor/golang.org/x/sys/unix/syscall_zos_s390x.go
+++ b/vendor/golang.org/x/sys/unix/syscall_zos_s390x.go
@@ -192,7 +192,6 @@ func (cmsg *Cmsghdr) SetLen(length int) {
 
 //sys   fcntl(fd int, cmd int, arg int) (val int, err error)
 //sys	read(fd int, p []byte) (n int, err error)
-//sys   readlen(fd int, buf *byte, nbuf int) (n int, err error) = SYS_READ
 //sys	write(fd int, p []byte) (n int, err error)
 
 //sys	accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) = SYS___ACCEPT_A
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux.go b/vendor/golang.org/x/sys/unix/zerrors_linux.go
index 0787a043b..f9c7f479b 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux.go
@@ -2421,6 +2421,15 @@ const (
 	PR_PAC_GET_ENABLED_KEYS                     = 0x3d
 	PR_PAC_RESET_KEYS                           = 0x36
 	PR_PAC_SET_ENABLED_KEYS                     = 0x3c
+	PR_RISCV_V_GET_CONTROL                      = 0x46
+	PR_RISCV_V_SET_CONTROL                      = 0x45
+	PR_RISCV_V_VSTATE_CTRL_CUR_MASK             = 0x3
+	PR_RISCV_V_VSTATE_CTRL_DEFAULT              = 0x0
+	PR_RISCV_V_VSTATE_CTRL_INHERIT              = 0x10
+	PR_RISCV_V_VSTATE_CTRL_MASK                 = 0x1f
+	PR_RISCV_V_VSTATE_CTRL_NEXT_MASK            = 0xc
+	PR_RISCV_V_VSTATE_CTRL_OFF                  = 0x1
+	PR_RISCV_V_VSTATE_CTRL_ON                   = 0x2
 	PR_SCHED_CORE                               = 0x3e
 	PR_SCHED_CORE_CREATE                        = 0x1
 	PR_SCHED_CORE_GET                           = 0x0
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_386.go b/vendor/golang.org/x/sys/unix/zerrors_linux_386.go
index cfb143001..30aee00a5 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_386.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_386.go
@@ -326,10 +326,12 @@ const (
 	SO_NOFCS                         = 0x2b
 	SO_OOBINLINE                     = 0xa
 	SO_PASSCRED                      = 0x10
+	SO_PASSPIDFD                     = 0x4c
 	SO_PASSSEC                       = 0x22
 	SO_PEEK_OFF                      = 0x2a
 	SO_PEERCRED                      = 0x11
 	SO_PEERGROUPS                    = 0x3b
+	SO_PEERPIDFD                     = 0x4d
 	SO_PEERSEC                       = 0x1f
 	SO_PREFER_BUSY_POLL              = 0x45
 	SO_PROTOCOL                      = 0x26
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go b/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go
index df64f2d59..8ebfa5127 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_amd64.go
@@ -327,10 +327,12 @@ const (
 	SO_NOFCS                         = 0x2b
 	SO_OOBINLINE                     = 0xa
 	SO_PASSCRED                      = 0x10
+	SO_PASSPIDFD                     = 0x4c
 	SO_PASSSEC                       = 0x22
 	SO_PEEK_OFF                      = 0x2a
 	SO_PEERCRED                      = 0x11
 	SO_PEERGROUPS                    = 0x3b
+	SO_PEERPIDFD                     = 0x4d
 	SO_PEERSEC                       = 0x1f
 	SO_PREFER_BUSY_POLL              = 0x45
 	SO_PROTOCOL                      = 0x26
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_arm.go b/vendor/golang.org/x/sys/unix/zerrors_linux_arm.go
index 3025cd5b2..271a21cdc 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_arm.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_arm.go
@@ -333,10 +333,12 @@ const (
 	SO_NOFCS                         = 0x2b
 	SO_OOBINLINE                     = 0xa
 	SO_PASSCRED                      = 0x10
+	SO_PASSPIDFD                     = 0x4c
 	SO_PASSSEC                       = 0x22
 	SO_PEEK_OFF                      = 0x2a
 	SO_PEERCRED                      = 0x11
 	SO_PEERGROUPS                    = 0x3b
+	SO_PEERPIDFD                     = 0x4d
 	SO_PEERSEC                       = 0x1f
 	SO_PREFER_BUSY_POLL              = 0x45
 	SO_PROTOCOL                      = 0x26
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go b/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go
index 09e1ffbef..910c330a3 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_arm64.go
@@ -323,10 +323,12 @@ const (
 	SO_NOFCS                         = 0x2b
 	SO_OOBINLINE                     = 0xa
 	SO_PASSCRED                      = 0x10
+	SO_PASSPIDFD                     = 0x4c
 	SO_PASSSEC                       = 0x22
 	SO_PEEK_OFF                      = 0x2a
 	SO_PEERCRED                      = 0x11
 	SO_PEERGROUPS                    = 0x3b
+	SO_PEERPIDFD                     = 0x4d
 	SO_PEERSEC                       = 0x1f
 	SO_PREFER_BUSY_POLL              = 0x45
 	SO_PROTOCOL                      = 0x26
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go b/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go
index a45723540..a640798c9 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_loong64.go
@@ -118,6 +118,8 @@ const (
 	IUCLC                            = 0x200
 	IXOFF                            = 0x1000
 	IXON                             = 0x400
+	LASX_CTX_MAGIC                   = 0x41535801
+	LSX_CTX_MAGIC                    = 0x53580001
 	MAP_ANON                         = 0x20
 	MAP_ANONYMOUS                    = 0x20
 	MAP_DENYWRITE                    = 0x800
@@ -317,10 +319,12 @@ const (
 	SO_NOFCS                         = 0x2b
 	SO_OOBINLINE                     = 0xa
 	SO_PASSCRED                      = 0x10
+	SO_PASSPIDFD                     = 0x4c
 	SO_PASSSEC                       = 0x22
 	SO_PEEK_OFF                      = 0x2a
 	SO_PEERCRED                      = 0x11
 	SO_PEERGROUPS                    = 0x3b
+	SO_PEERPIDFD                     = 0x4d
 	SO_PEERSEC                       = 0x1f
 	SO_PREFER_BUSY_POLL              = 0x45
 	SO_PROTOCOL                      = 0x26
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_mips.go b/vendor/golang.org/x/sys/unix/zerrors_linux_mips.go
index fee7dfb81..0d5925d34 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_mips.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_mips.go
@@ -326,10 +326,12 @@ const (
 	SO_NOFCS                         = 0x2b
 	SO_OOBINLINE                     = 0x100
 	SO_PASSCRED                      = 0x11
+	SO_PASSPIDFD                     = 0x4c
 	SO_PASSSEC                       = 0x22
 	SO_PEEK_OFF                      = 0x2a
 	SO_PEERCRED                      = 0x12
 	SO_PEERGROUPS                    = 0x3b
+	SO_PEERPIDFD                     = 0x4d
 	SO_PEERSEC                       = 0x1e
 	SO_PREFER_BUSY_POLL              = 0x45
 	SO_PROTOCOL                      = 0x1028
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go b/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go
index a5b2373ae..d72a00e0b 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_mips64.go
@@ -326,10 +326,12 @@ const (
 	SO_NOFCS                         = 0x2b
 	SO_OOBINLINE                     = 0x100
 	SO_PASSCRED                      = 0x11
+	SO_PASSPIDFD                     = 0x4c
 	SO_PASSSEC                       = 0x22
 	SO_PEEK_OFF                      = 0x2a
 	SO_PEERCRED                      = 0x12
 	SO_PEERGROUPS                    = 0x3b
+	SO_PEERPIDFD                     = 0x4d
 	SO_PEERSEC                       = 0x1e
 	SO_PREFER_BUSY_POLL              = 0x45
 	SO_PROTOCOL                      = 0x1028
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go b/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go
index 5dde82c98..02ba129f8 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_mips64le.go
@@ -326,10 +326,12 @@ const (
 	SO_NOFCS                         = 0x2b
 	SO_OOBINLINE                     = 0x100
 	SO_PASSCRED                      = 0x11
+	SO_PASSPIDFD                     = 0x4c
 	SO_PASSSEC                       = 0x22
 	SO_PEEK_OFF                      = 0x2a
 	SO_PEERCRED                      = 0x12
 	SO_PEERGROUPS                    = 0x3b
+	SO_PEERPIDFD                     = 0x4d
 	SO_PEERSEC                       = 0x1e
 	SO_PREFER_BUSY_POLL              = 0x45
 	SO_PROTOCOL                      = 0x1028
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go b/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go
index 2e80ea6b3..8daa6dd96 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_mipsle.go
@@ -326,10 +326,12 @@ const (
 	SO_NOFCS                         = 0x2b
 	SO_OOBINLINE                     = 0x100
 	SO_PASSCRED                      = 0x11
+	SO_PASSPIDFD                     = 0x4c
 	SO_PASSSEC                       = 0x22
 	SO_PEEK_OFF                      = 0x2a
 	SO_PEERCRED                      = 0x12
 	SO_PEERGROUPS                    = 0x3b
+	SO_PEERPIDFD                     = 0x4d
 	SO_PEERSEC                       = 0x1e
 	SO_PREFER_BUSY_POLL              = 0x45
 	SO_PROTOCOL                      = 0x1028
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go b/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go
index a65dcd7cb..63c8fa2f7 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_ppc.go
@@ -381,10 +381,12 @@ const (
 	SO_NOFCS                         = 0x2b
 	SO_OOBINLINE                     = 0xa
 	SO_PASSCRED                      = 0x14
+	SO_PASSPIDFD                     = 0x4c
 	SO_PASSSEC                       = 0x22
 	SO_PEEK_OFF                      = 0x2a
 	SO_PEERCRED                      = 0x15
 	SO_PEERGROUPS                    = 0x3b
+	SO_PEERPIDFD                     = 0x4d
 	SO_PEERSEC                       = 0x1f
 	SO_PREFER_BUSY_POLL              = 0x45
 	SO_PROTOCOL                      = 0x26
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go b/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go
index cbd34e3d8..930799ec1 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64.go
@@ -385,10 +385,12 @@ const (
 	SO_NOFCS                         = 0x2b
 	SO_OOBINLINE                     = 0xa
 	SO_PASSCRED                      = 0x14
+	SO_PASSPIDFD                     = 0x4c
 	SO_PASSSEC                       = 0x22
 	SO_PEEK_OFF                      = 0x2a
 	SO_PEERCRED                      = 0x15
 	SO_PEERGROUPS                    = 0x3b
+	SO_PEERPIDFD                     = 0x4d
 	SO_PEERSEC                       = 0x1f
 	SO_PREFER_BUSY_POLL              = 0x45
 	SO_PROTOCOL                      = 0x26
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go b/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go
index e4afa7a31..8605a7dd7 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_ppc64le.go
@@ -385,10 +385,12 @@ const (
 	SO_NOFCS                         = 0x2b
 	SO_OOBINLINE                     = 0xa
 	SO_PASSCRED                      = 0x14
+	SO_PASSPIDFD                     = 0x4c
 	SO_PASSSEC                       = 0x22
 	SO_PEEK_OFF                      = 0x2a
 	SO_PEERCRED                      = 0x15
 	SO_PEERGROUPS                    = 0x3b
+	SO_PEERPIDFD                     = 0x4d
 	SO_PEERSEC                       = 0x1f
 	SO_PREFER_BUSY_POLL              = 0x45
 	SO_PROTOCOL                      = 0x26
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go b/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go
index 44f45a039..95a016f1c 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_riscv64.go
@@ -314,10 +314,12 @@ const (
 	SO_NOFCS                         = 0x2b
 	SO_OOBINLINE                     = 0xa
 	SO_PASSCRED                      = 0x10
+	SO_PASSPIDFD                     = 0x4c
 	SO_PASSSEC                       = 0x22
 	SO_PEEK_OFF                      = 0x2a
 	SO_PEERCRED                      = 0x11
 	SO_PEERGROUPS                    = 0x3b
+	SO_PEERPIDFD                     = 0x4d
 	SO_PEERSEC                       = 0x1f
 	SO_PREFER_BUSY_POLL              = 0x45
 	SO_PROTOCOL                      = 0x26
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go b/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go
index 74733e260..1ae0108f5 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_s390x.go
@@ -389,10 +389,12 @@ const (
 	SO_NOFCS                         = 0x2b
 	SO_OOBINLINE                     = 0xa
 	SO_PASSCRED                      = 0x10
+	SO_PASSPIDFD                     = 0x4c
 	SO_PASSSEC                       = 0x22
 	SO_PEEK_OFF                      = 0x2a
 	SO_PEERCRED                      = 0x11
 	SO_PEERGROUPS                    = 0x3b
+	SO_PEERPIDFD                     = 0x4d
 	SO_PEERSEC                       = 0x1f
 	SO_PREFER_BUSY_POLL              = 0x45
 	SO_PROTOCOL                      = 0x26
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go b/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go
index f5f3934b1..1bb7c6333 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux_sparc64.go
@@ -428,10 +428,12 @@ const (
 	SO_NOFCS                         = 0x27
 	SO_OOBINLINE                     = 0x100
 	SO_PASSCRED                      = 0x2
+	SO_PASSPIDFD                     = 0x55
 	SO_PASSSEC                       = 0x1f
 	SO_PEEK_OFF                      = 0x26
 	SO_PEERCRED                      = 0x40
 	SO_PEERGROUPS                    = 0x3d
+	SO_PEERPIDFD                     = 0x56
 	SO_PEERSEC                       = 0x1e
 	SO_PREFER_BUSY_POLL              = 0x48
 	SO_PROTOCOL                      = 0x1028
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc.go b/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc.go
index 9a257219d..d1d1d2331 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc.go
@@ -817,28 +817,6 @@ func write(fd int, p []byte) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, p *byte, np int) (n int, err error) {
-	r0, er := C.read(C.int(fd), C.uintptr_t(uintptr(unsafe.Pointer(p))), C.size_t(np))
-	n = int(r0)
-	if r0 == -1 && er != nil {
-		err = er
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, p *byte, np int) (n int, err error) {
-	r0, er := C.write(C.int(fd), C.uintptr_t(uintptr(unsafe.Pointer(p))), C.size_t(np))
-	n = int(r0)
-	if r0 == -1 && er != nil {
-		err = er
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Dup2(oldfd int, newfd int) (err error) {
 	r0, er := C.dup2(C.int(oldfd), C.int(newfd))
 	if r0 == -1 && er != nil {
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc64.go b/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc64.go
index 6de80c20c..f99a18adc 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_aix_ppc64.go
@@ -762,28 +762,6 @@ func write(fd int, p []byte) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, p *byte, np int) (n int, err error) {
-	r0, e1 := callread(fd, uintptr(unsafe.Pointer(p)), np)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, p *byte, np int) (n int, err error) {
-	r0, e1 := callwrite(fd, uintptr(unsafe.Pointer(p)), np)
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Dup2(oldfd int, newfd int) (err error) {
 	_, e1 := calldup2(oldfd, newfd)
 	if e1 != 0 {
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.go b/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.go
index 4037ccf7a..1cad561e9 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.go
@@ -725,6 +725,12 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 	return
 }
 
+var libc_ioctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ioctl ioctl "/usr/lib/libSystem.B.dylib"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
@@ -733,10 +739,6 @@ func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	return
 }
 
-var libc_ioctl_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_ioctl ioctl "/usr/lib/libSystem.B.dylib"
-
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
@@ -2410,28 +2412,6 @@ var libc_munmap_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fstat(fd int, stat *Stat_t) (err error) {
 	_, _, e1 := syscall_syscall(libc_fstat64_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
@@ -2521,14 +2501,6 @@ func ptrace1(request int, pid int, addr uintptr, data uintptr) (err error) {
 	return
 }
 
-func ptrace1Ptr(request int, pid int, addr uintptr, data unsafe.Pointer) (err error) {
-	_, _, e1 := syscall_syscall6(libc_ptrace_trampoline_addr, uintptr(request), uintptr(pid), addr, uintptr(data), 0, 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
 var libc_ptrace_trampoline_addr uintptr
 
 //go:cgo_import_dynamic libc_ptrace ptrace "/usr/lib/libSystem.B.dylib"
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.s b/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.s
index 4baaed0bc..8b8bb2840 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.s
+++ b/vendor/golang.org/x/sys/unix/zsyscall_darwin_amd64.s
@@ -5,703 +5,586 @@
 
 TEXT libc_fdopendir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fdopendir(SB)
-
 GLOBL	·libc_fdopendir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fdopendir_trampoline_addr(SB)/8, $libc_fdopendir_trampoline<>(SB)
 
 TEXT libc_getgroups_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getgroups(SB)
-
 GLOBL	·libc_getgroups_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getgroups_trampoline_addr(SB)/8, $libc_getgroups_trampoline<>(SB)
 
 TEXT libc_setgroups_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setgroups(SB)
-
 GLOBL	·libc_setgroups_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setgroups_trampoline_addr(SB)/8, $libc_setgroups_trampoline<>(SB)
 
 TEXT libc_wait4_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_wait4(SB)
-
 GLOBL	·libc_wait4_trampoline_addr(SB), RODATA, $8
 DATA	·libc_wait4_trampoline_addr(SB)/8, $libc_wait4_trampoline<>(SB)
 
 TEXT libc_accept_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_accept(SB)
-
 GLOBL	·libc_accept_trampoline_addr(SB), RODATA, $8
 DATA	·libc_accept_trampoline_addr(SB)/8, $libc_accept_trampoline<>(SB)
 
 TEXT libc_bind_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_bind(SB)
-
 GLOBL	·libc_bind_trampoline_addr(SB), RODATA, $8
 DATA	·libc_bind_trampoline_addr(SB)/8, $libc_bind_trampoline<>(SB)
 
 TEXT libc_connect_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_connect(SB)
-
 GLOBL	·libc_connect_trampoline_addr(SB), RODATA, $8
 DATA	·libc_connect_trampoline_addr(SB)/8, $libc_connect_trampoline<>(SB)
 
 TEXT libc_socket_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_socket(SB)
-
 GLOBL	·libc_socket_trampoline_addr(SB), RODATA, $8
 DATA	·libc_socket_trampoline_addr(SB)/8, $libc_socket_trampoline<>(SB)
 
 TEXT libc_getsockopt_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getsockopt(SB)
-
 GLOBL	·libc_getsockopt_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getsockopt_trampoline_addr(SB)/8, $libc_getsockopt_trampoline<>(SB)
 
 TEXT libc_setsockopt_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setsockopt(SB)
-
 GLOBL	·libc_setsockopt_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setsockopt_trampoline_addr(SB)/8, $libc_setsockopt_trampoline<>(SB)
 
 TEXT libc_getpeername_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpeername(SB)
-
 GLOBL	·libc_getpeername_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpeername_trampoline_addr(SB)/8, $libc_getpeername_trampoline<>(SB)
 
 TEXT libc_getsockname_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getsockname(SB)
-
 GLOBL	·libc_getsockname_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getsockname_trampoline_addr(SB)/8, $libc_getsockname_trampoline<>(SB)
 
 TEXT libc_shutdown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_shutdown(SB)
-
 GLOBL	·libc_shutdown_trampoline_addr(SB), RODATA, $8
 DATA	·libc_shutdown_trampoline_addr(SB)/8, $libc_shutdown_trampoline<>(SB)
 
 TEXT libc_socketpair_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_socketpair(SB)
-
 GLOBL	·libc_socketpair_trampoline_addr(SB), RODATA, $8
 DATA	·libc_socketpair_trampoline_addr(SB)/8, $libc_socketpair_trampoline<>(SB)
 
 TEXT libc_recvfrom_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_recvfrom(SB)
-
 GLOBL	·libc_recvfrom_trampoline_addr(SB), RODATA, $8
 DATA	·libc_recvfrom_trampoline_addr(SB)/8, $libc_recvfrom_trampoline<>(SB)
 
 TEXT libc_sendto_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sendto(SB)
-
 GLOBL	·libc_sendto_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sendto_trampoline_addr(SB)/8, $libc_sendto_trampoline<>(SB)
 
 TEXT libc_recvmsg_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_recvmsg(SB)
-
 GLOBL	·libc_recvmsg_trampoline_addr(SB), RODATA, $8
 DATA	·libc_recvmsg_trampoline_addr(SB)/8, $libc_recvmsg_trampoline<>(SB)
 
 TEXT libc_sendmsg_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sendmsg(SB)
-
 GLOBL	·libc_sendmsg_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sendmsg_trampoline_addr(SB)/8, $libc_sendmsg_trampoline<>(SB)
 
 TEXT libc_kevent_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_kevent(SB)
-
 GLOBL	·libc_kevent_trampoline_addr(SB), RODATA, $8
 DATA	·libc_kevent_trampoline_addr(SB)/8, $libc_kevent_trampoline<>(SB)
 
 TEXT libc_utimes_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_utimes(SB)
-
 GLOBL	·libc_utimes_trampoline_addr(SB), RODATA, $8
 DATA	·libc_utimes_trampoline_addr(SB)/8, $libc_utimes_trampoline<>(SB)
 
 TEXT libc_futimes_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_futimes(SB)
-
 GLOBL	·libc_futimes_trampoline_addr(SB), RODATA, $8
 DATA	·libc_futimes_trampoline_addr(SB)/8, $libc_futimes_trampoline<>(SB)
 
 TEXT libc_poll_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_poll(SB)
-
 GLOBL	·libc_poll_trampoline_addr(SB), RODATA, $8
 DATA	·libc_poll_trampoline_addr(SB)/8, $libc_poll_trampoline<>(SB)
 
 TEXT libc_madvise_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_madvise(SB)
-
 GLOBL	·libc_madvise_trampoline_addr(SB), RODATA, $8
 DATA	·libc_madvise_trampoline_addr(SB)/8, $libc_madvise_trampoline<>(SB)
 
 TEXT libc_mlock_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mlock(SB)
-
 GLOBL	·libc_mlock_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mlock_trampoline_addr(SB)/8, $libc_mlock_trampoline<>(SB)
 
 TEXT libc_mlockall_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mlockall(SB)
-
 GLOBL	·libc_mlockall_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mlockall_trampoline_addr(SB)/8, $libc_mlockall_trampoline<>(SB)
 
 TEXT libc_mprotect_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mprotect(SB)
-
 GLOBL	·libc_mprotect_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mprotect_trampoline_addr(SB)/8, $libc_mprotect_trampoline<>(SB)
 
 TEXT libc_msync_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_msync(SB)
-
 GLOBL	·libc_msync_trampoline_addr(SB), RODATA, $8
 DATA	·libc_msync_trampoline_addr(SB)/8, $libc_msync_trampoline<>(SB)
 
 TEXT libc_munlock_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_munlock(SB)
-
 GLOBL	·libc_munlock_trampoline_addr(SB), RODATA, $8
 DATA	·libc_munlock_trampoline_addr(SB)/8, $libc_munlock_trampoline<>(SB)
 
 TEXT libc_munlockall_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_munlockall(SB)
-
 GLOBL	·libc_munlockall_trampoline_addr(SB), RODATA, $8
 DATA	·libc_munlockall_trampoline_addr(SB)/8, $libc_munlockall_trampoline<>(SB)
 
 TEXT libc_closedir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_closedir(SB)
-
 GLOBL	·libc_closedir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_closedir_trampoline_addr(SB)/8, $libc_closedir_trampoline<>(SB)
 
 TEXT libc_readdir_r_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_readdir_r(SB)
-
 GLOBL	·libc_readdir_r_trampoline_addr(SB), RODATA, $8
 DATA	·libc_readdir_r_trampoline_addr(SB)/8, $libc_readdir_r_trampoline<>(SB)
 
 TEXT libc_pipe_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pipe(SB)
-
 GLOBL	·libc_pipe_trampoline_addr(SB), RODATA, $8
 DATA	·libc_pipe_trampoline_addr(SB)/8, $libc_pipe_trampoline<>(SB)
 
 TEXT libc_getxattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getxattr(SB)
-
 GLOBL	·libc_getxattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getxattr_trampoline_addr(SB)/8, $libc_getxattr_trampoline<>(SB)
 
 TEXT libc_fgetxattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fgetxattr(SB)
-
 GLOBL	·libc_fgetxattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fgetxattr_trampoline_addr(SB)/8, $libc_fgetxattr_trampoline<>(SB)
 
 TEXT libc_setxattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setxattr(SB)
-
 GLOBL	·libc_setxattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setxattr_trampoline_addr(SB)/8, $libc_setxattr_trampoline<>(SB)
 
 TEXT libc_fsetxattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fsetxattr(SB)
-
 GLOBL	·libc_fsetxattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fsetxattr_trampoline_addr(SB)/8, $libc_fsetxattr_trampoline<>(SB)
 
 TEXT libc_removexattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_removexattr(SB)
-
 GLOBL	·libc_removexattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_removexattr_trampoline_addr(SB)/8, $libc_removexattr_trampoline<>(SB)
 
 TEXT libc_fremovexattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fremovexattr(SB)
-
 GLOBL	·libc_fremovexattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fremovexattr_trampoline_addr(SB)/8, $libc_fremovexattr_trampoline<>(SB)
 
 TEXT libc_listxattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_listxattr(SB)
-
 GLOBL	·libc_listxattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_listxattr_trampoline_addr(SB)/8, $libc_listxattr_trampoline<>(SB)
 
 TEXT libc_flistxattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_flistxattr(SB)
-
 GLOBL	·libc_flistxattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_flistxattr_trampoline_addr(SB)/8, $libc_flistxattr_trampoline<>(SB)
 
 TEXT libc_utimensat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_utimensat(SB)
-
 GLOBL	·libc_utimensat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_utimensat_trampoline_addr(SB)/8, $libc_utimensat_trampoline<>(SB)
 
 TEXT libc_fcntl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fcntl(SB)
-
 GLOBL	·libc_fcntl_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fcntl_trampoline_addr(SB)/8, $libc_fcntl_trampoline<>(SB)
 
 TEXT libc_kill_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_kill(SB)
-
 GLOBL	·libc_kill_trampoline_addr(SB), RODATA, $8
 DATA	·libc_kill_trampoline_addr(SB)/8, $libc_kill_trampoline<>(SB)
 
 TEXT libc_ioctl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ioctl(SB)
-
 GLOBL	·libc_ioctl_trampoline_addr(SB), RODATA, $8
 DATA	·libc_ioctl_trampoline_addr(SB)/8, $libc_ioctl_trampoline<>(SB)
 
 TEXT libc_sysctl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sysctl(SB)
-
 GLOBL	·libc_sysctl_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sysctl_trampoline_addr(SB)/8, $libc_sysctl_trampoline<>(SB)
 
 TEXT libc_sendfile_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sendfile(SB)
-
 GLOBL	·libc_sendfile_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sendfile_trampoline_addr(SB)/8, $libc_sendfile_trampoline<>(SB)
 
 TEXT libc_shmat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_shmat(SB)
-
 GLOBL	·libc_shmat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_shmat_trampoline_addr(SB)/8, $libc_shmat_trampoline<>(SB)
 
 TEXT libc_shmctl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_shmctl(SB)
-
 GLOBL	·libc_shmctl_trampoline_addr(SB), RODATA, $8
 DATA	·libc_shmctl_trampoline_addr(SB)/8, $libc_shmctl_trampoline<>(SB)
 
 TEXT libc_shmdt_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_shmdt(SB)
-
 GLOBL	·libc_shmdt_trampoline_addr(SB), RODATA, $8
 DATA	·libc_shmdt_trampoline_addr(SB)/8, $libc_shmdt_trampoline<>(SB)
 
 TEXT libc_shmget_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_shmget(SB)
-
 GLOBL	·libc_shmget_trampoline_addr(SB), RODATA, $8
 DATA	·libc_shmget_trampoline_addr(SB)/8, $libc_shmget_trampoline<>(SB)
 
 TEXT libc_access_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_access(SB)
-
 GLOBL	·libc_access_trampoline_addr(SB), RODATA, $8
 DATA	·libc_access_trampoline_addr(SB)/8, $libc_access_trampoline<>(SB)
 
 TEXT libc_adjtime_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_adjtime(SB)
-
 GLOBL	·libc_adjtime_trampoline_addr(SB), RODATA, $8
 DATA	·libc_adjtime_trampoline_addr(SB)/8, $libc_adjtime_trampoline<>(SB)
 
 TEXT libc_chdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chdir(SB)
-
 GLOBL	·libc_chdir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chdir_trampoline_addr(SB)/8, $libc_chdir_trampoline<>(SB)
 
 TEXT libc_chflags_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chflags(SB)
-
 GLOBL	·libc_chflags_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chflags_trampoline_addr(SB)/8, $libc_chflags_trampoline<>(SB)
 
 TEXT libc_chmod_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chmod(SB)
-
 GLOBL	·libc_chmod_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chmod_trampoline_addr(SB)/8, $libc_chmod_trampoline<>(SB)
 
 TEXT libc_chown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chown(SB)
-
 GLOBL	·libc_chown_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chown_trampoline_addr(SB)/8, $libc_chown_trampoline<>(SB)
 
 TEXT libc_chroot_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chroot(SB)
-
 GLOBL	·libc_chroot_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chroot_trampoline_addr(SB)/8, $libc_chroot_trampoline<>(SB)
 
 TEXT libc_clock_gettime_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_clock_gettime(SB)
-
 GLOBL	·libc_clock_gettime_trampoline_addr(SB), RODATA, $8
 DATA	·libc_clock_gettime_trampoline_addr(SB)/8, $libc_clock_gettime_trampoline<>(SB)
 
 TEXT libc_close_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_close(SB)
-
 GLOBL	·libc_close_trampoline_addr(SB), RODATA, $8
 DATA	·libc_close_trampoline_addr(SB)/8, $libc_close_trampoline<>(SB)
 
 TEXT libc_clonefile_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_clonefile(SB)
-
 GLOBL	·libc_clonefile_trampoline_addr(SB), RODATA, $8
 DATA	·libc_clonefile_trampoline_addr(SB)/8, $libc_clonefile_trampoline<>(SB)
 
 TEXT libc_clonefileat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_clonefileat(SB)
-
 GLOBL	·libc_clonefileat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_clonefileat_trampoline_addr(SB)/8, $libc_clonefileat_trampoline<>(SB)
 
 TEXT libc_dup_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_dup(SB)
-
 GLOBL	·libc_dup_trampoline_addr(SB), RODATA, $8
 DATA	·libc_dup_trampoline_addr(SB)/8, $libc_dup_trampoline<>(SB)
 
 TEXT libc_dup2_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_dup2(SB)
-
 GLOBL	·libc_dup2_trampoline_addr(SB), RODATA, $8
 DATA	·libc_dup2_trampoline_addr(SB)/8, $libc_dup2_trampoline<>(SB)
 
 TEXT libc_exchangedata_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_exchangedata(SB)
-
 GLOBL	·libc_exchangedata_trampoline_addr(SB), RODATA, $8
 DATA	·libc_exchangedata_trampoline_addr(SB)/8, $libc_exchangedata_trampoline<>(SB)
 
 TEXT libc_exit_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_exit(SB)
-
 GLOBL	·libc_exit_trampoline_addr(SB), RODATA, $8
 DATA	·libc_exit_trampoline_addr(SB)/8, $libc_exit_trampoline<>(SB)
 
 TEXT libc_faccessat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_faccessat(SB)
-
 GLOBL	·libc_faccessat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_faccessat_trampoline_addr(SB)/8, $libc_faccessat_trampoline<>(SB)
 
 TEXT libc_fchdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchdir(SB)
-
 GLOBL	·libc_fchdir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchdir_trampoline_addr(SB)/8, $libc_fchdir_trampoline<>(SB)
 
 TEXT libc_fchflags_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchflags(SB)
-
 GLOBL	·libc_fchflags_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchflags_trampoline_addr(SB)/8, $libc_fchflags_trampoline<>(SB)
 
 TEXT libc_fchmod_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchmod(SB)
-
 GLOBL	·libc_fchmod_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchmod_trampoline_addr(SB)/8, $libc_fchmod_trampoline<>(SB)
 
 TEXT libc_fchmodat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchmodat(SB)
-
 GLOBL	·libc_fchmodat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchmodat_trampoline_addr(SB)/8, $libc_fchmodat_trampoline<>(SB)
 
 TEXT libc_fchown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchown(SB)
-
 GLOBL	·libc_fchown_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchown_trampoline_addr(SB)/8, $libc_fchown_trampoline<>(SB)
 
 TEXT libc_fchownat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchownat(SB)
-
 GLOBL	·libc_fchownat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchownat_trampoline_addr(SB)/8, $libc_fchownat_trampoline<>(SB)
 
 TEXT libc_fclonefileat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fclonefileat(SB)
-
 GLOBL	·libc_fclonefileat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fclonefileat_trampoline_addr(SB)/8, $libc_fclonefileat_trampoline<>(SB)
 
 TEXT libc_flock_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_flock(SB)
-
 GLOBL	·libc_flock_trampoline_addr(SB), RODATA, $8
 DATA	·libc_flock_trampoline_addr(SB)/8, $libc_flock_trampoline<>(SB)
 
 TEXT libc_fpathconf_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fpathconf(SB)
-
 GLOBL	·libc_fpathconf_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fpathconf_trampoline_addr(SB)/8, $libc_fpathconf_trampoline<>(SB)
 
 TEXT libc_fsync_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fsync(SB)
-
 GLOBL	·libc_fsync_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fsync_trampoline_addr(SB)/8, $libc_fsync_trampoline<>(SB)
 
 TEXT libc_ftruncate_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ftruncate(SB)
-
 GLOBL	·libc_ftruncate_trampoline_addr(SB), RODATA, $8
 DATA	·libc_ftruncate_trampoline_addr(SB)/8, $libc_ftruncate_trampoline<>(SB)
 
 TEXT libc_getcwd_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getcwd(SB)
-
 GLOBL	·libc_getcwd_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getcwd_trampoline_addr(SB)/8, $libc_getcwd_trampoline<>(SB)
 
 TEXT libc_getdtablesize_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getdtablesize(SB)
-
 GLOBL	·libc_getdtablesize_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getdtablesize_trampoline_addr(SB)/8, $libc_getdtablesize_trampoline<>(SB)
 
 TEXT libc_getegid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getegid(SB)
-
 GLOBL	·libc_getegid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getegid_trampoline_addr(SB)/8, $libc_getegid_trampoline<>(SB)
 
 TEXT libc_geteuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_geteuid(SB)
-
 GLOBL	·libc_geteuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_geteuid_trampoline_addr(SB)/8, $libc_geteuid_trampoline<>(SB)
 
 TEXT libc_getgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getgid(SB)
-
 GLOBL	·libc_getgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getgid_trampoline_addr(SB)/8, $libc_getgid_trampoline<>(SB)
 
 TEXT libc_getpgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpgid(SB)
-
 GLOBL	·libc_getpgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpgid_trampoline_addr(SB)/8, $libc_getpgid_trampoline<>(SB)
 
 TEXT libc_getpgrp_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpgrp(SB)
-
 GLOBL	·libc_getpgrp_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpgrp_trampoline_addr(SB)/8, $libc_getpgrp_trampoline<>(SB)
 
 TEXT libc_getpid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpid(SB)
-
 GLOBL	·libc_getpid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpid_trampoline_addr(SB)/8, $libc_getpid_trampoline<>(SB)
 
 TEXT libc_getppid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getppid(SB)
-
 GLOBL	·libc_getppid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getppid_trampoline_addr(SB)/8, $libc_getppid_trampoline<>(SB)
 
 TEXT libc_getpriority_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpriority(SB)
-
 GLOBL	·libc_getpriority_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpriority_trampoline_addr(SB)/8, $libc_getpriority_trampoline<>(SB)
 
 TEXT libc_getrlimit_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getrlimit(SB)
-
 GLOBL	·libc_getrlimit_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getrlimit_trampoline_addr(SB)/8, $libc_getrlimit_trampoline<>(SB)
 
 TEXT libc_getrusage_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getrusage(SB)
-
 GLOBL	·libc_getrusage_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getrusage_trampoline_addr(SB)/8, $libc_getrusage_trampoline<>(SB)
 
 TEXT libc_getsid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getsid(SB)
-
 GLOBL	·libc_getsid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getsid_trampoline_addr(SB)/8, $libc_getsid_trampoline<>(SB)
 
 TEXT libc_gettimeofday_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_gettimeofday(SB)
-
 GLOBL	·libc_gettimeofday_trampoline_addr(SB), RODATA, $8
 DATA	·libc_gettimeofday_trampoline_addr(SB)/8, $libc_gettimeofday_trampoline<>(SB)
 
 TEXT libc_getuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getuid(SB)
-
 GLOBL	·libc_getuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getuid_trampoline_addr(SB)/8, $libc_getuid_trampoline<>(SB)
 
 TEXT libc_issetugid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_issetugid(SB)
-
 GLOBL	·libc_issetugid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_issetugid_trampoline_addr(SB)/8, $libc_issetugid_trampoline<>(SB)
 
 TEXT libc_kqueue_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_kqueue(SB)
-
 GLOBL	·libc_kqueue_trampoline_addr(SB), RODATA, $8
 DATA	·libc_kqueue_trampoline_addr(SB)/8, $libc_kqueue_trampoline<>(SB)
 
 TEXT libc_lchown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_lchown(SB)
-
 GLOBL	·libc_lchown_trampoline_addr(SB), RODATA, $8
 DATA	·libc_lchown_trampoline_addr(SB)/8, $libc_lchown_trampoline<>(SB)
 
 TEXT libc_link_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_link(SB)
-
 GLOBL	·libc_link_trampoline_addr(SB), RODATA, $8
 DATA	·libc_link_trampoline_addr(SB)/8, $libc_link_trampoline<>(SB)
 
 TEXT libc_linkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_linkat(SB)
-
 GLOBL	·libc_linkat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_linkat_trampoline_addr(SB)/8, $libc_linkat_trampoline<>(SB)
 
 TEXT libc_listen_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_listen(SB)
-
 GLOBL	·libc_listen_trampoline_addr(SB), RODATA, $8
 DATA	·libc_listen_trampoline_addr(SB)/8, $libc_listen_trampoline<>(SB)
 
 TEXT libc_mkdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkdir(SB)
-
 GLOBL	·libc_mkdir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mkdir_trampoline_addr(SB)/8, $libc_mkdir_trampoline<>(SB)
 
 TEXT libc_mkdirat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkdirat(SB)
-
 GLOBL	·libc_mkdirat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mkdirat_trampoline_addr(SB)/8, $libc_mkdirat_trampoline<>(SB)
 
 TEXT libc_mkfifo_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkfifo(SB)
-
 GLOBL	·libc_mkfifo_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mkfifo_trampoline_addr(SB)/8, $libc_mkfifo_trampoline<>(SB)
 
 TEXT libc_mknod_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mknod(SB)
-
 GLOBL	·libc_mknod_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mknod_trampoline_addr(SB)/8, $libc_mknod_trampoline<>(SB)
 
 TEXT libc_mount_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mount(SB)
-
 GLOBL	·libc_mount_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mount_trampoline_addr(SB)/8, $libc_mount_trampoline<>(SB)
 
 TEXT libc_open_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_open(SB)
-
 GLOBL	·libc_open_trampoline_addr(SB), RODATA, $8
 DATA	·libc_open_trampoline_addr(SB)/8, $libc_open_trampoline<>(SB)
 
 TEXT libc_openat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_openat(SB)
-
 GLOBL	·libc_openat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_openat_trampoline_addr(SB)/8, $libc_openat_trampoline<>(SB)
 
 TEXT libc_pathconf_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pathconf(SB)
-
 GLOBL	·libc_pathconf_trampoline_addr(SB), RODATA, $8
 DATA	·libc_pathconf_trampoline_addr(SB)/8, $libc_pathconf_trampoline<>(SB)
 
 TEXT libc_pread_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pread(SB)
-
 GLOBL	·libc_pread_trampoline_addr(SB), RODATA, $8
 DATA	·libc_pread_trampoline_addr(SB)/8, $libc_pread_trampoline<>(SB)
 
 TEXT libc_pwrite_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pwrite(SB)
-
 GLOBL	·libc_pwrite_trampoline_addr(SB), RODATA, $8
 DATA	·libc_pwrite_trampoline_addr(SB)/8, $libc_pwrite_trampoline<>(SB)
 
 TEXT libc_read_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_read(SB)
-
 GLOBL	·libc_read_trampoline_addr(SB), RODATA, $8
 DATA	·libc_read_trampoline_addr(SB)/8, $libc_read_trampoline<>(SB)
 
 TEXT libc_readlink_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_readlink(SB)
-
 GLOBL	·libc_readlink_trampoline_addr(SB), RODATA, $8
 DATA	·libc_readlink_trampoline_addr(SB)/8, $libc_readlink_trampoline<>(SB)
 
 TEXT libc_readlinkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_readlinkat(SB)
-
 GLOBL	·libc_readlinkat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_readlinkat_trampoline_addr(SB)/8, $libc_readlinkat_trampoline<>(SB)
 
 TEXT libc_rename_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_rename(SB)
-
 GLOBL	·libc_rename_trampoline_addr(SB), RODATA, $8
 DATA	·libc_rename_trampoline_addr(SB)/8, $libc_rename_trampoline<>(SB)
 
 TEXT libc_renameat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_renameat(SB)
-
 GLOBL	·libc_renameat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_renameat_trampoline_addr(SB)/8, $libc_renameat_trampoline<>(SB)
 
 TEXT libc_revoke_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_revoke(SB)
-
 GLOBL	·libc_revoke_trampoline_addr(SB), RODATA, $8
 DATA	·libc_revoke_trampoline_addr(SB)/8, $libc_revoke_trampoline<>(SB)
 
 TEXT libc_rmdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_rmdir(SB)
-
 GLOBL	·libc_rmdir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_rmdir_trampoline_addr(SB)/8, $libc_rmdir_trampoline<>(SB)
 
 TEXT libc_lseek_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_lseek(SB)
-
 GLOBL	·libc_lseek_trampoline_addr(SB), RODATA, $8
 DATA	·libc_lseek_trampoline_addr(SB)/8, $libc_lseek_trampoline<>(SB)
 
 TEXT libc_select_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_select(SB)
-
 GLOBL	·libc_select_trampoline_addr(SB), RODATA, $8
 DATA	·libc_select_trampoline_addr(SB)/8, $libc_select_trampoline<>(SB)
 
@@ -712,192 +595,160 @@ DATA	·libc_setattrlist_trampoline_addr(SB)/8, $libc_setattrlist_trampoline<>(SB
 
 TEXT libc_setegid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setegid(SB)
-
 GLOBL	·libc_setegid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setegid_trampoline_addr(SB)/8, $libc_setegid_trampoline<>(SB)
 
 TEXT libc_seteuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_seteuid(SB)
-
 GLOBL	·libc_seteuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_seteuid_trampoline_addr(SB)/8, $libc_seteuid_trampoline<>(SB)
 
 TEXT libc_setgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setgid(SB)
-
 GLOBL	·libc_setgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setgid_trampoline_addr(SB)/8, $libc_setgid_trampoline<>(SB)
 
 TEXT libc_setlogin_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setlogin(SB)
-
 GLOBL	·libc_setlogin_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setlogin_trampoline_addr(SB)/8, $libc_setlogin_trampoline<>(SB)
 
 TEXT libc_setpgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setpgid(SB)
-
 GLOBL	·libc_setpgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setpgid_trampoline_addr(SB)/8, $libc_setpgid_trampoline<>(SB)
 
 TEXT libc_setpriority_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setpriority(SB)
-
 GLOBL	·libc_setpriority_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setpriority_trampoline_addr(SB)/8, $libc_setpriority_trampoline<>(SB)
 
 TEXT libc_setprivexec_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setprivexec(SB)
-
 GLOBL	·libc_setprivexec_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setprivexec_trampoline_addr(SB)/8, $libc_setprivexec_trampoline<>(SB)
 
 TEXT libc_setregid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setregid(SB)
-
 GLOBL	·libc_setregid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setregid_trampoline_addr(SB)/8, $libc_setregid_trampoline<>(SB)
 
 TEXT libc_setreuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setreuid(SB)
-
 GLOBL	·libc_setreuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setreuid_trampoline_addr(SB)/8, $libc_setreuid_trampoline<>(SB)
 
 TEXT libc_setsid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setsid(SB)
-
 GLOBL	·libc_setsid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setsid_trampoline_addr(SB)/8, $libc_setsid_trampoline<>(SB)
 
 TEXT libc_settimeofday_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_settimeofday(SB)
-
 GLOBL	·libc_settimeofday_trampoline_addr(SB), RODATA, $8
 DATA	·libc_settimeofday_trampoline_addr(SB)/8, $libc_settimeofday_trampoline<>(SB)
 
 TEXT libc_setuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setuid(SB)
-
 GLOBL	·libc_setuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setuid_trampoline_addr(SB)/8, $libc_setuid_trampoline<>(SB)
 
 TEXT libc_symlink_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_symlink(SB)
-
 GLOBL	·libc_symlink_trampoline_addr(SB), RODATA, $8
 DATA	·libc_symlink_trampoline_addr(SB)/8, $libc_symlink_trampoline<>(SB)
 
 TEXT libc_symlinkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_symlinkat(SB)
-
 GLOBL	·libc_symlinkat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_symlinkat_trampoline_addr(SB)/8, $libc_symlinkat_trampoline<>(SB)
 
 TEXT libc_sync_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sync(SB)
-
 GLOBL	·libc_sync_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sync_trampoline_addr(SB)/8, $libc_sync_trampoline<>(SB)
 
 TEXT libc_truncate_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_truncate(SB)
-
 GLOBL	·libc_truncate_trampoline_addr(SB), RODATA, $8
 DATA	·libc_truncate_trampoline_addr(SB)/8, $libc_truncate_trampoline<>(SB)
 
 TEXT libc_umask_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_umask(SB)
-
 GLOBL	·libc_umask_trampoline_addr(SB), RODATA, $8
 DATA	·libc_umask_trampoline_addr(SB)/8, $libc_umask_trampoline<>(SB)
 
 TEXT libc_undelete_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_undelete(SB)
-
 GLOBL	·libc_undelete_trampoline_addr(SB), RODATA, $8
 DATA	·libc_undelete_trampoline_addr(SB)/8, $libc_undelete_trampoline<>(SB)
 
 TEXT libc_unlink_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_unlink(SB)
-
 GLOBL	·libc_unlink_trampoline_addr(SB), RODATA, $8
 DATA	·libc_unlink_trampoline_addr(SB)/8, $libc_unlink_trampoline<>(SB)
 
 TEXT libc_unlinkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_unlinkat(SB)
-
 GLOBL	·libc_unlinkat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_unlinkat_trampoline_addr(SB)/8, $libc_unlinkat_trampoline<>(SB)
 
 TEXT libc_unmount_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_unmount(SB)
-
 GLOBL	·libc_unmount_trampoline_addr(SB), RODATA, $8
 DATA	·libc_unmount_trampoline_addr(SB)/8, $libc_unmount_trampoline<>(SB)
 
 TEXT libc_write_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_write(SB)
-
 GLOBL	·libc_write_trampoline_addr(SB), RODATA, $8
 DATA	·libc_write_trampoline_addr(SB)/8, $libc_write_trampoline<>(SB)
 
 TEXT libc_mmap_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mmap(SB)
-
 GLOBL	·libc_mmap_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mmap_trampoline_addr(SB)/8, $libc_mmap_trampoline<>(SB)
 
 TEXT libc_munmap_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_munmap(SB)
-
 GLOBL	·libc_munmap_trampoline_addr(SB), RODATA, $8
 DATA	·libc_munmap_trampoline_addr(SB)/8, $libc_munmap_trampoline<>(SB)
 
 TEXT libc_fstat64_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fstat64(SB)
-
 GLOBL	·libc_fstat64_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fstat64_trampoline_addr(SB)/8, $libc_fstat64_trampoline<>(SB)
 
 TEXT libc_fstatat64_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fstatat64(SB)
-
 GLOBL	·libc_fstatat64_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fstatat64_trampoline_addr(SB)/8, $libc_fstatat64_trampoline<>(SB)
 
 TEXT libc_fstatfs64_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fstatfs64(SB)
-
 GLOBL	·libc_fstatfs64_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fstatfs64_trampoline_addr(SB)/8, $libc_fstatfs64_trampoline<>(SB)
 
 TEXT libc_getfsstat64_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getfsstat64(SB)
-
 GLOBL	·libc_getfsstat64_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getfsstat64_trampoline_addr(SB)/8, $libc_getfsstat64_trampoline<>(SB)
 
 TEXT libc_lstat64_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_lstat64(SB)
-
 GLOBL	·libc_lstat64_trampoline_addr(SB), RODATA, $8
 DATA	·libc_lstat64_trampoline_addr(SB)/8, $libc_lstat64_trampoline<>(SB)
 
 TEXT libc_ptrace_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ptrace(SB)
-
 GLOBL	·libc_ptrace_trampoline_addr(SB), RODATA, $8
 DATA	·libc_ptrace_trampoline_addr(SB)/8, $libc_ptrace_trampoline<>(SB)
 
 TEXT libc_stat64_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_stat64(SB)
-
 GLOBL	·libc_stat64_trampoline_addr(SB), RODATA, $8
 DATA	·libc_stat64_trampoline_addr(SB)/8, $libc_stat64_trampoline<>(SB)
 
 TEXT libc_statfs64_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_statfs64(SB)
-
 GLOBL	·libc_statfs64_trampoline_addr(SB), RODATA, $8
 DATA	·libc_statfs64_trampoline_addr(SB)/8, $libc_statfs64_trampoline<>(SB)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go b/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go
index 51d6f3fb2..b18edbd0e 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.go
@@ -725,6 +725,12 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 	return
 }
 
+var libc_ioctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ioctl ioctl "/usr/lib/libSystem.B.dylib"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
@@ -733,10 +739,6 @@ func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	return
 }
 
-var libc_ioctl_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_ioctl ioctl "/usr/lib/libSystem.B.dylib"
-
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
@@ -2410,28 +2412,6 @@ var libc_munmap_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func Fstat(fd int, stat *Stat_t) (err error) {
 	_, _, e1 := syscall_syscall(libc_fstat_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0)
 	if e1 != 0 {
@@ -2521,14 +2501,6 @@ func ptrace1(request int, pid int, addr uintptr, data uintptr) (err error) {
 	return
 }
 
-func ptrace1Ptr(request int, pid int, addr uintptr, data unsafe.Pointer) (err error) {
-	_, _, e1 := syscall_syscall6(libc_ptrace_trampoline_addr, uintptr(request), uintptr(pid), addr, uintptr(data), 0, 0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
 var libc_ptrace_trampoline_addr uintptr
 
 //go:cgo_import_dynamic libc_ptrace ptrace "/usr/lib/libSystem.B.dylib"
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.s b/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.s
index c3b82c037..08362c1ab 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.s
+++ b/vendor/golang.org/x/sys/unix/zsyscall_darwin_arm64.s
@@ -5,703 +5,586 @@
 
 TEXT libc_fdopendir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fdopendir(SB)
-
 GLOBL	·libc_fdopendir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fdopendir_trampoline_addr(SB)/8, $libc_fdopendir_trampoline<>(SB)
 
 TEXT libc_getgroups_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getgroups(SB)
-
 GLOBL	·libc_getgroups_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getgroups_trampoline_addr(SB)/8, $libc_getgroups_trampoline<>(SB)
 
 TEXT libc_setgroups_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setgroups(SB)
-
 GLOBL	·libc_setgroups_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setgroups_trampoline_addr(SB)/8, $libc_setgroups_trampoline<>(SB)
 
 TEXT libc_wait4_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_wait4(SB)
-
 GLOBL	·libc_wait4_trampoline_addr(SB), RODATA, $8
 DATA	·libc_wait4_trampoline_addr(SB)/8, $libc_wait4_trampoline<>(SB)
 
 TEXT libc_accept_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_accept(SB)
-
 GLOBL	·libc_accept_trampoline_addr(SB), RODATA, $8
 DATA	·libc_accept_trampoline_addr(SB)/8, $libc_accept_trampoline<>(SB)
 
 TEXT libc_bind_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_bind(SB)
-
 GLOBL	·libc_bind_trampoline_addr(SB), RODATA, $8
 DATA	·libc_bind_trampoline_addr(SB)/8, $libc_bind_trampoline<>(SB)
 
 TEXT libc_connect_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_connect(SB)
-
 GLOBL	·libc_connect_trampoline_addr(SB), RODATA, $8
 DATA	·libc_connect_trampoline_addr(SB)/8, $libc_connect_trampoline<>(SB)
 
 TEXT libc_socket_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_socket(SB)
-
 GLOBL	·libc_socket_trampoline_addr(SB), RODATA, $8
 DATA	·libc_socket_trampoline_addr(SB)/8, $libc_socket_trampoline<>(SB)
 
 TEXT libc_getsockopt_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getsockopt(SB)
-
 GLOBL	·libc_getsockopt_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getsockopt_trampoline_addr(SB)/8, $libc_getsockopt_trampoline<>(SB)
 
 TEXT libc_setsockopt_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setsockopt(SB)
-
 GLOBL	·libc_setsockopt_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setsockopt_trampoline_addr(SB)/8, $libc_setsockopt_trampoline<>(SB)
 
 TEXT libc_getpeername_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpeername(SB)
-
 GLOBL	·libc_getpeername_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpeername_trampoline_addr(SB)/8, $libc_getpeername_trampoline<>(SB)
 
 TEXT libc_getsockname_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getsockname(SB)
-
 GLOBL	·libc_getsockname_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getsockname_trampoline_addr(SB)/8, $libc_getsockname_trampoline<>(SB)
 
 TEXT libc_shutdown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_shutdown(SB)
-
 GLOBL	·libc_shutdown_trampoline_addr(SB), RODATA, $8
 DATA	·libc_shutdown_trampoline_addr(SB)/8, $libc_shutdown_trampoline<>(SB)
 
 TEXT libc_socketpair_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_socketpair(SB)
-
 GLOBL	·libc_socketpair_trampoline_addr(SB), RODATA, $8
 DATA	·libc_socketpair_trampoline_addr(SB)/8, $libc_socketpair_trampoline<>(SB)
 
 TEXT libc_recvfrom_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_recvfrom(SB)
-
 GLOBL	·libc_recvfrom_trampoline_addr(SB), RODATA, $8
 DATA	·libc_recvfrom_trampoline_addr(SB)/8, $libc_recvfrom_trampoline<>(SB)
 
 TEXT libc_sendto_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sendto(SB)
-
 GLOBL	·libc_sendto_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sendto_trampoline_addr(SB)/8, $libc_sendto_trampoline<>(SB)
 
 TEXT libc_recvmsg_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_recvmsg(SB)
-
 GLOBL	·libc_recvmsg_trampoline_addr(SB), RODATA, $8
 DATA	·libc_recvmsg_trampoline_addr(SB)/8, $libc_recvmsg_trampoline<>(SB)
 
 TEXT libc_sendmsg_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sendmsg(SB)
-
 GLOBL	·libc_sendmsg_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sendmsg_trampoline_addr(SB)/8, $libc_sendmsg_trampoline<>(SB)
 
 TEXT libc_kevent_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_kevent(SB)
-
 GLOBL	·libc_kevent_trampoline_addr(SB), RODATA, $8
 DATA	·libc_kevent_trampoline_addr(SB)/8, $libc_kevent_trampoline<>(SB)
 
 TEXT libc_utimes_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_utimes(SB)
-
 GLOBL	·libc_utimes_trampoline_addr(SB), RODATA, $8
 DATA	·libc_utimes_trampoline_addr(SB)/8, $libc_utimes_trampoline<>(SB)
 
 TEXT libc_futimes_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_futimes(SB)
-
 GLOBL	·libc_futimes_trampoline_addr(SB), RODATA, $8
 DATA	·libc_futimes_trampoline_addr(SB)/8, $libc_futimes_trampoline<>(SB)
 
 TEXT libc_poll_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_poll(SB)
-
 GLOBL	·libc_poll_trampoline_addr(SB), RODATA, $8
 DATA	·libc_poll_trampoline_addr(SB)/8, $libc_poll_trampoline<>(SB)
 
 TEXT libc_madvise_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_madvise(SB)
-
 GLOBL	·libc_madvise_trampoline_addr(SB), RODATA, $8
 DATA	·libc_madvise_trampoline_addr(SB)/8, $libc_madvise_trampoline<>(SB)
 
 TEXT libc_mlock_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mlock(SB)
-
 GLOBL	·libc_mlock_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mlock_trampoline_addr(SB)/8, $libc_mlock_trampoline<>(SB)
 
 TEXT libc_mlockall_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mlockall(SB)
-
 GLOBL	·libc_mlockall_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mlockall_trampoline_addr(SB)/8, $libc_mlockall_trampoline<>(SB)
 
 TEXT libc_mprotect_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mprotect(SB)
-
 GLOBL	·libc_mprotect_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mprotect_trampoline_addr(SB)/8, $libc_mprotect_trampoline<>(SB)
 
 TEXT libc_msync_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_msync(SB)
-
 GLOBL	·libc_msync_trampoline_addr(SB), RODATA, $8
 DATA	·libc_msync_trampoline_addr(SB)/8, $libc_msync_trampoline<>(SB)
 
 TEXT libc_munlock_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_munlock(SB)
-
 GLOBL	·libc_munlock_trampoline_addr(SB), RODATA, $8
 DATA	·libc_munlock_trampoline_addr(SB)/8, $libc_munlock_trampoline<>(SB)
 
 TEXT libc_munlockall_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_munlockall(SB)
-
 GLOBL	·libc_munlockall_trampoline_addr(SB), RODATA, $8
 DATA	·libc_munlockall_trampoline_addr(SB)/8, $libc_munlockall_trampoline<>(SB)
 
 TEXT libc_closedir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_closedir(SB)
-
 GLOBL	·libc_closedir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_closedir_trampoline_addr(SB)/8, $libc_closedir_trampoline<>(SB)
 
 TEXT libc_readdir_r_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_readdir_r(SB)
-
 GLOBL	·libc_readdir_r_trampoline_addr(SB), RODATA, $8
 DATA	·libc_readdir_r_trampoline_addr(SB)/8, $libc_readdir_r_trampoline<>(SB)
 
 TEXT libc_pipe_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pipe(SB)
-
 GLOBL	·libc_pipe_trampoline_addr(SB), RODATA, $8
 DATA	·libc_pipe_trampoline_addr(SB)/8, $libc_pipe_trampoline<>(SB)
 
 TEXT libc_getxattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getxattr(SB)
-
 GLOBL	·libc_getxattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getxattr_trampoline_addr(SB)/8, $libc_getxattr_trampoline<>(SB)
 
 TEXT libc_fgetxattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fgetxattr(SB)
-
 GLOBL	·libc_fgetxattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fgetxattr_trampoline_addr(SB)/8, $libc_fgetxattr_trampoline<>(SB)
 
 TEXT libc_setxattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setxattr(SB)
-
 GLOBL	·libc_setxattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setxattr_trampoline_addr(SB)/8, $libc_setxattr_trampoline<>(SB)
 
 TEXT libc_fsetxattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fsetxattr(SB)
-
 GLOBL	·libc_fsetxattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fsetxattr_trampoline_addr(SB)/8, $libc_fsetxattr_trampoline<>(SB)
 
 TEXT libc_removexattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_removexattr(SB)
-
 GLOBL	·libc_removexattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_removexattr_trampoline_addr(SB)/8, $libc_removexattr_trampoline<>(SB)
 
 TEXT libc_fremovexattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fremovexattr(SB)
-
 GLOBL	·libc_fremovexattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fremovexattr_trampoline_addr(SB)/8, $libc_fremovexattr_trampoline<>(SB)
 
 TEXT libc_listxattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_listxattr(SB)
-
 GLOBL	·libc_listxattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_listxattr_trampoline_addr(SB)/8, $libc_listxattr_trampoline<>(SB)
 
 TEXT libc_flistxattr_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_flistxattr(SB)
-
 GLOBL	·libc_flistxattr_trampoline_addr(SB), RODATA, $8
 DATA	·libc_flistxattr_trampoline_addr(SB)/8, $libc_flistxattr_trampoline<>(SB)
 
 TEXT libc_utimensat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_utimensat(SB)
-
 GLOBL	·libc_utimensat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_utimensat_trampoline_addr(SB)/8, $libc_utimensat_trampoline<>(SB)
 
 TEXT libc_fcntl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fcntl(SB)
-
 GLOBL	·libc_fcntl_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fcntl_trampoline_addr(SB)/8, $libc_fcntl_trampoline<>(SB)
 
 TEXT libc_kill_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_kill(SB)
-
 GLOBL	·libc_kill_trampoline_addr(SB), RODATA, $8
 DATA	·libc_kill_trampoline_addr(SB)/8, $libc_kill_trampoline<>(SB)
 
 TEXT libc_ioctl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ioctl(SB)
-
 GLOBL	·libc_ioctl_trampoline_addr(SB), RODATA, $8
 DATA	·libc_ioctl_trampoline_addr(SB)/8, $libc_ioctl_trampoline<>(SB)
 
 TEXT libc_sysctl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sysctl(SB)
-
 GLOBL	·libc_sysctl_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sysctl_trampoline_addr(SB)/8, $libc_sysctl_trampoline<>(SB)
 
 TEXT libc_sendfile_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sendfile(SB)
-
 GLOBL	·libc_sendfile_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sendfile_trampoline_addr(SB)/8, $libc_sendfile_trampoline<>(SB)
 
 TEXT libc_shmat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_shmat(SB)
-
 GLOBL	·libc_shmat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_shmat_trampoline_addr(SB)/8, $libc_shmat_trampoline<>(SB)
 
 TEXT libc_shmctl_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_shmctl(SB)
-
 GLOBL	·libc_shmctl_trampoline_addr(SB), RODATA, $8
 DATA	·libc_shmctl_trampoline_addr(SB)/8, $libc_shmctl_trampoline<>(SB)
 
 TEXT libc_shmdt_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_shmdt(SB)
-
 GLOBL	·libc_shmdt_trampoline_addr(SB), RODATA, $8
 DATA	·libc_shmdt_trampoline_addr(SB)/8, $libc_shmdt_trampoline<>(SB)
 
 TEXT libc_shmget_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_shmget(SB)
-
 GLOBL	·libc_shmget_trampoline_addr(SB), RODATA, $8
 DATA	·libc_shmget_trampoline_addr(SB)/8, $libc_shmget_trampoline<>(SB)
 
 TEXT libc_access_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_access(SB)
-
 GLOBL	·libc_access_trampoline_addr(SB), RODATA, $8
 DATA	·libc_access_trampoline_addr(SB)/8, $libc_access_trampoline<>(SB)
 
 TEXT libc_adjtime_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_adjtime(SB)
-
 GLOBL	·libc_adjtime_trampoline_addr(SB), RODATA, $8
 DATA	·libc_adjtime_trampoline_addr(SB)/8, $libc_adjtime_trampoline<>(SB)
 
 TEXT libc_chdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chdir(SB)
-
 GLOBL	·libc_chdir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chdir_trampoline_addr(SB)/8, $libc_chdir_trampoline<>(SB)
 
 TEXT libc_chflags_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chflags(SB)
-
 GLOBL	·libc_chflags_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chflags_trampoline_addr(SB)/8, $libc_chflags_trampoline<>(SB)
 
 TEXT libc_chmod_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chmod(SB)
-
 GLOBL	·libc_chmod_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chmod_trampoline_addr(SB)/8, $libc_chmod_trampoline<>(SB)
 
 TEXT libc_chown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chown(SB)
-
 GLOBL	·libc_chown_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chown_trampoline_addr(SB)/8, $libc_chown_trampoline<>(SB)
 
 TEXT libc_chroot_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_chroot(SB)
-
 GLOBL	·libc_chroot_trampoline_addr(SB), RODATA, $8
 DATA	·libc_chroot_trampoline_addr(SB)/8, $libc_chroot_trampoline<>(SB)
 
 TEXT libc_clock_gettime_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_clock_gettime(SB)
-
 GLOBL	·libc_clock_gettime_trampoline_addr(SB), RODATA, $8
 DATA	·libc_clock_gettime_trampoline_addr(SB)/8, $libc_clock_gettime_trampoline<>(SB)
 
 TEXT libc_close_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_close(SB)
-
 GLOBL	·libc_close_trampoline_addr(SB), RODATA, $8
 DATA	·libc_close_trampoline_addr(SB)/8, $libc_close_trampoline<>(SB)
 
 TEXT libc_clonefile_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_clonefile(SB)
-
 GLOBL	·libc_clonefile_trampoline_addr(SB), RODATA, $8
 DATA	·libc_clonefile_trampoline_addr(SB)/8, $libc_clonefile_trampoline<>(SB)
 
 TEXT libc_clonefileat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_clonefileat(SB)
-
 GLOBL	·libc_clonefileat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_clonefileat_trampoline_addr(SB)/8, $libc_clonefileat_trampoline<>(SB)
 
 TEXT libc_dup_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_dup(SB)
-
 GLOBL	·libc_dup_trampoline_addr(SB), RODATA, $8
 DATA	·libc_dup_trampoline_addr(SB)/8, $libc_dup_trampoline<>(SB)
 
 TEXT libc_dup2_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_dup2(SB)
-
 GLOBL	·libc_dup2_trampoline_addr(SB), RODATA, $8
 DATA	·libc_dup2_trampoline_addr(SB)/8, $libc_dup2_trampoline<>(SB)
 
 TEXT libc_exchangedata_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_exchangedata(SB)
-
 GLOBL	·libc_exchangedata_trampoline_addr(SB), RODATA, $8
 DATA	·libc_exchangedata_trampoline_addr(SB)/8, $libc_exchangedata_trampoline<>(SB)
 
 TEXT libc_exit_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_exit(SB)
-
 GLOBL	·libc_exit_trampoline_addr(SB), RODATA, $8
 DATA	·libc_exit_trampoline_addr(SB)/8, $libc_exit_trampoline<>(SB)
 
 TEXT libc_faccessat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_faccessat(SB)
-
 GLOBL	·libc_faccessat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_faccessat_trampoline_addr(SB)/8, $libc_faccessat_trampoline<>(SB)
 
 TEXT libc_fchdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchdir(SB)
-
 GLOBL	·libc_fchdir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchdir_trampoline_addr(SB)/8, $libc_fchdir_trampoline<>(SB)
 
 TEXT libc_fchflags_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchflags(SB)
-
 GLOBL	·libc_fchflags_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchflags_trampoline_addr(SB)/8, $libc_fchflags_trampoline<>(SB)
 
 TEXT libc_fchmod_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchmod(SB)
-
 GLOBL	·libc_fchmod_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchmod_trampoline_addr(SB)/8, $libc_fchmod_trampoline<>(SB)
 
 TEXT libc_fchmodat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchmodat(SB)
-
 GLOBL	·libc_fchmodat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchmodat_trampoline_addr(SB)/8, $libc_fchmodat_trampoline<>(SB)
 
 TEXT libc_fchown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchown(SB)
-
 GLOBL	·libc_fchown_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchown_trampoline_addr(SB)/8, $libc_fchown_trampoline<>(SB)
 
 TEXT libc_fchownat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fchownat(SB)
-
 GLOBL	·libc_fchownat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fchownat_trampoline_addr(SB)/8, $libc_fchownat_trampoline<>(SB)
 
 TEXT libc_fclonefileat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fclonefileat(SB)
-
 GLOBL	·libc_fclonefileat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fclonefileat_trampoline_addr(SB)/8, $libc_fclonefileat_trampoline<>(SB)
 
 TEXT libc_flock_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_flock(SB)
-
 GLOBL	·libc_flock_trampoline_addr(SB), RODATA, $8
 DATA	·libc_flock_trampoline_addr(SB)/8, $libc_flock_trampoline<>(SB)
 
 TEXT libc_fpathconf_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fpathconf(SB)
-
 GLOBL	·libc_fpathconf_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fpathconf_trampoline_addr(SB)/8, $libc_fpathconf_trampoline<>(SB)
 
 TEXT libc_fsync_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fsync(SB)
-
 GLOBL	·libc_fsync_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fsync_trampoline_addr(SB)/8, $libc_fsync_trampoline<>(SB)
 
 TEXT libc_ftruncate_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ftruncate(SB)
-
 GLOBL	·libc_ftruncate_trampoline_addr(SB), RODATA, $8
 DATA	·libc_ftruncate_trampoline_addr(SB)/8, $libc_ftruncate_trampoline<>(SB)
 
 TEXT libc_getcwd_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getcwd(SB)
-
 GLOBL	·libc_getcwd_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getcwd_trampoline_addr(SB)/8, $libc_getcwd_trampoline<>(SB)
 
 TEXT libc_getdtablesize_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getdtablesize(SB)
-
 GLOBL	·libc_getdtablesize_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getdtablesize_trampoline_addr(SB)/8, $libc_getdtablesize_trampoline<>(SB)
 
 TEXT libc_getegid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getegid(SB)
-
 GLOBL	·libc_getegid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getegid_trampoline_addr(SB)/8, $libc_getegid_trampoline<>(SB)
 
 TEXT libc_geteuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_geteuid(SB)
-
 GLOBL	·libc_geteuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_geteuid_trampoline_addr(SB)/8, $libc_geteuid_trampoline<>(SB)
 
 TEXT libc_getgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getgid(SB)
-
 GLOBL	·libc_getgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getgid_trampoline_addr(SB)/8, $libc_getgid_trampoline<>(SB)
 
 TEXT libc_getpgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpgid(SB)
-
 GLOBL	·libc_getpgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpgid_trampoline_addr(SB)/8, $libc_getpgid_trampoline<>(SB)
 
 TEXT libc_getpgrp_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpgrp(SB)
-
 GLOBL	·libc_getpgrp_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpgrp_trampoline_addr(SB)/8, $libc_getpgrp_trampoline<>(SB)
 
 TEXT libc_getpid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpid(SB)
-
 GLOBL	·libc_getpid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpid_trampoline_addr(SB)/8, $libc_getpid_trampoline<>(SB)
 
 TEXT libc_getppid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getppid(SB)
-
 GLOBL	·libc_getppid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getppid_trampoline_addr(SB)/8, $libc_getppid_trampoline<>(SB)
 
 TEXT libc_getpriority_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getpriority(SB)
-
 GLOBL	·libc_getpriority_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getpriority_trampoline_addr(SB)/8, $libc_getpriority_trampoline<>(SB)
 
 TEXT libc_getrlimit_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getrlimit(SB)
-
 GLOBL	·libc_getrlimit_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getrlimit_trampoline_addr(SB)/8, $libc_getrlimit_trampoline<>(SB)
 
 TEXT libc_getrusage_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getrusage(SB)
-
 GLOBL	·libc_getrusage_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getrusage_trampoline_addr(SB)/8, $libc_getrusage_trampoline<>(SB)
 
 TEXT libc_getsid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getsid(SB)
-
 GLOBL	·libc_getsid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getsid_trampoline_addr(SB)/8, $libc_getsid_trampoline<>(SB)
 
 TEXT libc_gettimeofday_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_gettimeofday(SB)
-
 GLOBL	·libc_gettimeofday_trampoline_addr(SB), RODATA, $8
 DATA	·libc_gettimeofday_trampoline_addr(SB)/8, $libc_gettimeofday_trampoline<>(SB)
 
 TEXT libc_getuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getuid(SB)
-
 GLOBL	·libc_getuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getuid_trampoline_addr(SB)/8, $libc_getuid_trampoline<>(SB)
 
 TEXT libc_issetugid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_issetugid(SB)
-
 GLOBL	·libc_issetugid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_issetugid_trampoline_addr(SB)/8, $libc_issetugid_trampoline<>(SB)
 
 TEXT libc_kqueue_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_kqueue(SB)
-
 GLOBL	·libc_kqueue_trampoline_addr(SB), RODATA, $8
 DATA	·libc_kqueue_trampoline_addr(SB)/8, $libc_kqueue_trampoline<>(SB)
 
 TEXT libc_lchown_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_lchown(SB)
-
 GLOBL	·libc_lchown_trampoline_addr(SB), RODATA, $8
 DATA	·libc_lchown_trampoline_addr(SB)/8, $libc_lchown_trampoline<>(SB)
 
 TEXT libc_link_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_link(SB)
-
 GLOBL	·libc_link_trampoline_addr(SB), RODATA, $8
 DATA	·libc_link_trampoline_addr(SB)/8, $libc_link_trampoline<>(SB)
 
 TEXT libc_linkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_linkat(SB)
-
 GLOBL	·libc_linkat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_linkat_trampoline_addr(SB)/8, $libc_linkat_trampoline<>(SB)
 
 TEXT libc_listen_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_listen(SB)
-
 GLOBL	·libc_listen_trampoline_addr(SB), RODATA, $8
 DATA	·libc_listen_trampoline_addr(SB)/8, $libc_listen_trampoline<>(SB)
 
 TEXT libc_mkdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkdir(SB)
-
 GLOBL	·libc_mkdir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mkdir_trampoline_addr(SB)/8, $libc_mkdir_trampoline<>(SB)
 
 TEXT libc_mkdirat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkdirat(SB)
-
 GLOBL	·libc_mkdirat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mkdirat_trampoline_addr(SB)/8, $libc_mkdirat_trampoline<>(SB)
 
 TEXT libc_mkfifo_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mkfifo(SB)
-
 GLOBL	·libc_mkfifo_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mkfifo_trampoline_addr(SB)/8, $libc_mkfifo_trampoline<>(SB)
 
 TEXT libc_mknod_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mknod(SB)
-
 GLOBL	·libc_mknod_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mknod_trampoline_addr(SB)/8, $libc_mknod_trampoline<>(SB)
 
 TEXT libc_mount_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mount(SB)
-
 GLOBL	·libc_mount_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mount_trampoline_addr(SB)/8, $libc_mount_trampoline<>(SB)
 
 TEXT libc_open_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_open(SB)
-
 GLOBL	·libc_open_trampoline_addr(SB), RODATA, $8
 DATA	·libc_open_trampoline_addr(SB)/8, $libc_open_trampoline<>(SB)
 
 TEXT libc_openat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_openat(SB)
-
 GLOBL	·libc_openat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_openat_trampoline_addr(SB)/8, $libc_openat_trampoline<>(SB)
 
 TEXT libc_pathconf_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pathconf(SB)
-
 GLOBL	·libc_pathconf_trampoline_addr(SB), RODATA, $8
 DATA	·libc_pathconf_trampoline_addr(SB)/8, $libc_pathconf_trampoline<>(SB)
 
 TEXT libc_pread_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pread(SB)
-
 GLOBL	·libc_pread_trampoline_addr(SB), RODATA, $8
 DATA	·libc_pread_trampoline_addr(SB)/8, $libc_pread_trampoline<>(SB)
 
 TEXT libc_pwrite_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_pwrite(SB)
-
 GLOBL	·libc_pwrite_trampoline_addr(SB), RODATA, $8
 DATA	·libc_pwrite_trampoline_addr(SB)/8, $libc_pwrite_trampoline<>(SB)
 
 TEXT libc_read_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_read(SB)
-
 GLOBL	·libc_read_trampoline_addr(SB), RODATA, $8
 DATA	·libc_read_trampoline_addr(SB)/8, $libc_read_trampoline<>(SB)
 
 TEXT libc_readlink_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_readlink(SB)
-
 GLOBL	·libc_readlink_trampoline_addr(SB), RODATA, $8
 DATA	·libc_readlink_trampoline_addr(SB)/8, $libc_readlink_trampoline<>(SB)
 
 TEXT libc_readlinkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_readlinkat(SB)
-
 GLOBL	·libc_readlinkat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_readlinkat_trampoline_addr(SB)/8, $libc_readlinkat_trampoline<>(SB)
 
 TEXT libc_rename_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_rename(SB)
-
 GLOBL	·libc_rename_trampoline_addr(SB), RODATA, $8
 DATA	·libc_rename_trampoline_addr(SB)/8, $libc_rename_trampoline<>(SB)
 
 TEXT libc_renameat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_renameat(SB)
-
 GLOBL	·libc_renameat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_renameat_trampoline_addr(SB)/8, $libc_renameat_trampoline<>(SB)
 
 TEXT libc_revoke_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_revoke(SB)
-
 GLOBL	·libc_revoke_trampoline_addr(SB), RODATA, $8
 DATA	·libc_revoke_trampoline_addr(SB)/8, $libc_revoke_trampoline<>(SB)
 
 TEXT libc_rmdir_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_rmdir(SB)
-
 GLOBL	·libc_rmdir_trampoline_addr(SB), RODATA, $8
 DATA	·libc_rmdir_trampoline_addr(SB)/8, $libc_rmdir_trampoline<>(SB)
 
 TEXT libc_lseek_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_lseek(SB)
-
 GLOBL	·libc_lseek_trampoline_addr(SB), RODATA, $8
 DATA	·libc_lseek_trampoline_addr(SB)/8, $libc_lseek_trampoline<>(SB)
 
 TEXT libc_select_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_select(SB)
-
 GLOBL	·libc_select_trampoline_addr(SB), RODATA, $8
 DATA	·libc_select_trampoline_addr(SB)/8, $libc_select_trampoline<>(SB)
 
@@ -712,192 +595,160 @@ DATA	·libc_setattrlist_trampoline_addr(SB)/8, $libc_setattrlist_trampoline<>(SB
 
 TEXT libc_setegid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setegid(SB)
-
 GLOBL	·libc_setegid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setegid_trampoline_addr(SB)/8, $libc_setegid_trampoline<>(SB)
 
 TEXT libc_seteuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_seteuid(SB)
-
 GLOBL	·libc_seteuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_seteuid_trampoline_addr(SB)/8, $libc_seteuid_trampoline<>(SB)
 
 TEXT libc_setgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setgid(SB)
-
 GLOBL	·libc_setgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setgid_trampoline_addr(SB)/8, $libc_setgid_trampoline<>(SB)
 
 TEXT libc_setlogin_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setlogin(SB)
-
 GLOBL	·libc_setlogin_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setlogin_trampoline_addr(SB)/8, $libc_setlogin_trampoline<>(SB)
 
 TEXT libc_setpgid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setpgid(SB)
-
 GLOBL	·libc_setpgid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setpgid_trampoline_addr(SB)/8, $libc_setpgid_trampoline<>(SB)
 
 TEXT libc_setpriority_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setpriority(SB)
-
 GLOBL	·libc_setpriority_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setpriority_trampoline_addr(SB)/8, $libc_setpriority_trampoline<>(SB)
 
 TEXT libc_setprivexec_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setprivexec(SB)
-
 GLOBL	·libc_setprivexec_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setprivexec_trampoline_addr(SB)/8, $libc_setprivexec_trampoline<>(SB)
 
 TEXT libc_setregid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setregid(SB)
-
 GLOBL	·libc_setregid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setregid_trampoline_addr(SB)/8, $libc_setregid_trampoline<>(SB)
 
 TEXT libc_setreuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setreuid(SB)
-
 GLOBL	·libc_setreuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setreuid_trampoline_addr(SB)/8, $libc_setreuid_trampoline<>(SB)
 
 TEXT libc_setsid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setsid(SB)
-
 GLOBL	·libc_setsid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setsid_trampoline_addr(SB)/8, $libc_setsid_trampoline<>(SB)
 
 TEXT libc_settimeofday_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_settimeofday(SB)
-
 GLOBL	·libc_settimeofday_trampoline_addr(SB), RODATA, $8
 DATA	·libc_settimeofday_trampoline_addr(SB)/8, $libc_settimeofday_trampoline<>(SB)
 
 TEXT libc_setuid_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_setuid(SB)
-
 GLOBL	·libc_setuid_trampoline_addr(SB), RODATA, $8
 DATA	·libc_setuid_trampoline_addr(SB)/8, $libc_setuid_trampoline<>(SB)
 
 TEXT libc_symlink_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_symlink(SB)
-
 GLOBL	·libc_symlink_trampoline_addr(SB), RODATA, $8
 DATA	·libc_symlink_trampoline_addr(SB)/8, $libc_symlink_trampoline<>(SB)
 
 TEXT libc_symlinkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_symlinkat(SB)
-
 GLOBL	·libc_symlinkat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_symlinkat_trampoline_addr(SB)/8, $libc_symlinkat_trampoline<>(SB)
 
 TEXT libc_sync_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_sync(SB)
-
 GLOBL	·libc_sync_trampoline_addr(SB), RODATA, $8
 DATA	·libc_sync_trampoline_addr(SB)/8, $libc_sync_trampoline<>(SB)
 
 TEXT libc_truncate_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_truncate(SB)
-
 GLOBL	·libc_truncate_trampoline_addr(SB), RODATA, $8
 DATA	·libc_truncate_trampoline_addr(SB)/8, $libc_truncate_trampoline<>(SB)
 
 TEXT libc_umask_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_umask(SB)
-
 GLOBL	·libc_umask_trampoline_addr(SB), RODATA, $8
 DATA	·libc_umask_trampoline_addr(SB)/8, $libc_umask_trampoline<>(SB)
 
 TEXT libc_undelete_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_undelete(SB)
-
 GLOBL	·libc_undelete_trampoline_addr(SB), RODATA, $8
 DATA	·libc_undelete_trampoline_addr(SB)/8, $libc_undelete_trampoline<>(SB)
 
 TEXT libc_unlink_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_unlink(SB)
-
 GLOBL	·libc_unlink_trampoline_addr(SB), RODATA, $8
 DATA	·libc_unlink_trampoline_addr(SB)/8, $libc_unlink_trampoline<>(SB)
 
 TEXT libc_unlinkat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_unlinkat(SB)
-
 GLOBL	·libc_unlinkat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_unlinkat_trampoline_addr(SB)/8, $libc_unlinkat_trampoline<>(SB)
 
 TEXT libc_unmount_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_unmount(SB)
-
 GLOBL	·libc_unmount_trampoline_addr(SB), RODATA, $8
 DATA	·libc_unmount_trampoline_addr(SB)/8, $libc_unmount_trampoline<>(SB)
 
 TEXT libc_write_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_write(SB)
-
 GLOBL	·libc_write_trampoline_addr(SB), RODATA, $8
 DATA	·libc_write_trampoline_addr(SB)/8, $libc_write_trampoline<>(SB)
 
 TEXT libc_mmap_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_mmap(SB)
-
 GLOBL	·libc_mmap_trampoline_addr(SB), RODATA, $8
 DATA	·libc_mmap_trampoline_addr(SB)/8, $libc_mmap_trampoline<>(SB)
 
 TEXT libc_munmap_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_munmap(SB)
-
 GLOBL	·libc_munmap_trampoline_addr(SB), RODATA, $8
 DATA	·libc_munmap_trampoline_addr(SB)/8, $libc_munmap_trampoline<>(SB)
 
 TEXT libc_fstat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fstat(SB)
-
 GLOBL	·libc_fstat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fstat_trampoline_addr(SB)/8, $libc_fstat_trampoline<>(SB)
 
 TEXT libc_fstatat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fstatat(SB)
-
 GLOBL	·libc_fstatat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fstatat_trampoline_addr(SB)/8, $libc_fstatat_trampoline<>(SB)
 
 TEXT libc_fstatfs_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_fstatfs(SB)
-
 GLOBL	·libc_fstatfs_trampoline_addr(SB), RODATA, $8
 DATA	·libc_fstatfs_trampoline_addr(SB)/8, $libc_fstatfs_trampoline<>(SB)
 
 TEXT libc_getfsstat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_getfsstat(SB)
-
 GLOBL	·libc_getfsstat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_getfsstat_trampoline_addr(SB)/8, $libc_getfsstat_trampoline<>(SB)
 
 TEXT libc_lstat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_lstat(SB)
-
 GLOBL	·libc_lstat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_lstat_trampoline_addr(SB)/8, $libc_lstat_trampoline<>(SB)
 
 TEXT libc_ptrace_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_ptrace(SB)
-
 GLOBL	·libc_ptrace_trampoline_addr(SB), RODATA, $8
 DATA	·libc_ptrace_trampoline_addr(SB)/8, $libc_ptrace_trampoline<>(SB)
 
 TEXT libc_stat_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_stat(SB)
-
 GLOBL	·libc_stat_trampoline_addr(SB), RODATA, $8
 DATA	·libc_stat_trampoline_addr(SB)/8, $libc_stat_trampoline<>(SB)
 
 TEXT libc_statfs_trampoline<>(SB),NOSPLIT,$0-0
 	JMP	libc_statfs(SB)
-
 GLOBL	·libc_statfs_trampoline_addr(SB), RODATA, $8
 DATA	·libc_statfs_trampoline_addr(SB)/8, $libc_statfs_trampoline<>(SB)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_dragonfly_amd64.go b/vendor/golang.org/x/sys/unix/zsyscall_dragonfly_amd64.go
index 0eabac7ad..0c67df64a 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_dragonfly_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_dragonfly_amd64.go
@@ -1642,28 +1642,6 @@ func munmap(addr uintptr, length uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func accept4(fd int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (nfd int, err error) {
 	r0, _, e1 := Syscall6(SYS_ACCEPT4, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
 	nfd = int(r0)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_386.go b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_386.go
index ee313eb00..e6e05d145 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_386.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_386.go
@@ -1862,28 +1862,6 @@ func munmap(addr uintptr, length uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func accept4(fd int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (nfd int, err error) {
 	r0, _, e1 := Syscall6(SYS_ACCEPT4, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
 	nfd = int(r0)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_amd64.go b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_amd64.go
index 4c986e448..7508accac 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_amd64.go
@@ -1862,28 +1862,6 @@ func munmap(addr uintptr, length uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func accept4(fd int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (nfd int, err error) {
 	r0, _, e1 := Syscall6(SYS_ACCEPT4, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
 	nfd = int(r0)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm.go b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm.go
index 555216944..7b56aead4 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm.go
@@ -1862,28 +1862,6 @@ func munmap(addr uintptr, length uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func accept4(fd int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (nfd int, err error) {
 	r0, _, e1 := Syscall6(SYS_ACCEPT4, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
 	nfd = int(r0)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm64.go b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm64.go
index 67a226fbf..cc623dcaa 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_arm64.go
@@ -1862,28 +1862,6 @@ func munmap(addr uintptr, length uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func accept4(fd int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (nfd int, err error) {
 	r0, _, e1 := Syscall6(SYS_ACCEPT4, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
 	nfd = int(r0)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_riscv64.go b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_riscv64.go
index f0b9ddaaa..581849197 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_freebsd_riscv64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_freebsd_riscv64.go
@@ -1862,28 +1862,6 @@ func munmap(addr uintptr, length uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func accept4(fd int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (nfd int, err error) {
 	r0, _, e1 := Syscall6(SYS_ACCEPT4, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
 	nfd = int(r0)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_illumos_amd64.go b/vendor/golang.org/x/sys/unix/zsyscall_illumos_amd64.go
index b57c7050d..6be25cd19 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_illumos_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_illumos_amd64.go
@@ -40,7 +40,7 @@ func readv(fd int, iovs []Iovec) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procreadv)), 3, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(len(iovs)), 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -55,7 +55,7 @@ func preadv(fd int, iovs []Iovec, off int64) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procpreadv)), 4, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(len(iovs)), uintptr(off), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -70,7 +70,7 @@ func writev(fd int, iovs []Iovec) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procwritev)), 3, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(len(iovs)), 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -85,7 +85,7 @@ func pwritev(fd int, iovs []Iovec, off int64) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procpwritev)), 4, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(len(iovs)), uintptr(off), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -96,7 +96,7 @@ func accept4(s int, rsa *RawSockaddrAny, addrlen *_Socklen, flags int) (fd int,
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procaccept4)), 4, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), uintptr(flags), 0, 0)
 	fd = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_linux.go b/vendor/golang.org/x/sys/unix/zsyscall_linux.go
index 14ab34a56..1ff3aec74 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux.go
@@ -1734,28 +1734,6 @@ func exitThread(code int) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, p *byte, np int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(p)), uintptr(np))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, p *byte, np int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(p)), uintptr(np))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func readv(fd int, iovs []Iovec) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(iovs) > 0 {
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_386.go b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_386.go
index 35f499b32..2df3c5bac 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_386.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_386.go
@@ -1824,28 +1824,6 @@ func munmap(addr uintptr, length uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_amd64.go b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_amd64.go
index 3cda65b0d..a60556bab 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_amd64.go
@@ -1824,28 +1824,6 @@ func munmap(addr uintptr, length uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm.go b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm.go
index 1e1fea902..9f788917a 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm.go
@@ -1824,28 +1824,6 @@ func munmap(addr uintptr, length uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm64.go b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm64.go
index 3b77da110..82a4cb2dc 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm64.go
@@ -1824,28 +1824,6 @@ func munmap(addr uintptr, length uintptr) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := Syscall(SYS_WRITE, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.go b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.go
index 9ab9abf72..66b3b6456 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_386.go
@@ -549,6 +549,12 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 	return
 }
 
+var libc_ioctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
@@ -557,10 +563,6 @@ func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	return
 }
 
-var libc_ioctl_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
-
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
@@ -2211,28 +2213,6 @@ var libc_munmap_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.go b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.go
index 915761eab..c5c4cc112 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_amd64.go
@@ -2213,28 +2213,6 @@ var libc_munmap_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.go b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.go
index 8e87fdf15..93bfbb328 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm.go
@@ -549,6 +549,12 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 	return
 }
 
+var libc_ioctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
@@ -557,10 +563,6 @@ func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	return
 }
 
-var libc_ioctl_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
-
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
@@ -2211,28 +2213,6 @@ var libc_munmap_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.go b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.go
index 12a7a2160..a107b8fda 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_arm64.go
@@ -549,6 +549,12 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 	return
 }
 
+var libc_ioctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
@@ -557,10 +563,6 @@ func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	return
 }
 
-var libc_ioctl_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
-
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
@@ -2211,28 +2213,6 @@ var libc_munmap_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.go b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.go
index b19e8aa03..c427de509 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_mips64.go
@@ -549,6 +549,12 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 	return
 }
 
+var libc_ioctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
@@ -557,10 +563,6 @@ func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	return
 }
 
-var libc_ioctl_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
-
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
@@ -2211,28 +2213,6 @@ var libc_munmap_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.go b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.go
index fb99594c9..60c1a99ae 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_ppc64.go
@@ -549,6 +549,12 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 	return
 }
 
+var libc_ioctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
@@ -557,10 +563,6 @@ func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	return
 }
 
-var libc_ioctl_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
-
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
@@ -2211,28 +2213,6 @@ var libc_munmap_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.go b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.go
index 32cbbbc52..52eba360f 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_openbsd_riscv64.go
@@ -549,6 +549,12 @@ func ioctl(fd int, req uint, arg uintptr) (err error) {
 	return
 }
 
+var libc_ioctl_trampoline_addr uintptr
+
+//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
+
+// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
+
 func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	_, _, e1 := syscall_syscall(libc_ioctl_trampoline_addr, uintptr(fd), uintptr(req), uintptr(arg))
 	if e1 != 0 {
@@ -557,10 +563,6 @@ func ioctlPtr(fd int, req uint, arg unsafe.Pointer) (err error) {
 	return
 }
 
-var libc_ioctl_trampoline_addr uintptr
-
-//go:cgo_import_dynamic libc_ioctl ioctl "libc.so"
-
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
 func sysctl(mib []_C_int, old *byte, oldlen *uintptr, new *byte, newlen uintptr) (err error) {
@@ -2211,28 +2213,6 @@ var libc_munmap_trampoline_addr uintptr
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_read_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
-func writelen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(libc_write_trampoline_addr, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func utimensat(dirfd int, path string, times *[2]Timespec, flags int) (err error) {
 	var _p0 *byte
 	_p0, err = BytePtrFromString(path)
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_solaris_amd64.go b/vendor/golang.org/x/sys/unix/zsyscall_solaris_amd64.go
index 609d1c598..b40189464 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_solaris_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_solaris_amd64.go
@@ -436,7 +436,7 @@ func pipe(p *[2]_C_int) (n int, err error) {
 	r0, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procpipe)), 1, uintptr(unsafe.Pointer(p)), 0, 0, 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -446,7 +446,7 @@ func pipe(p *[2]_C_int) (n int, err error) {
 func pipe2(p *[2]_C_int, flags int) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procpipe2)), 2, uintptr(unsafe.Pointer(p)), uintptr(flags), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -456,7 +456,7 @@ func pipe2(p *[2]_C_int, flags int) (err error) {
 func getsockname(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procgetsockname)), 3, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -471,7 +471,7 @@ func Getcwd(buf []byte) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procGetcwd)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(len(buf)), 0, 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -482,7 +482,7 @@ func getgroups(ngid int, gid *_Gid_t) (n int, err error) {
 	r0, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procgetgroups)), 2, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0, 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -492,7 +492,7 @@ func getgroups(ngid int, gid *_Gid_t) (n int, err error) {
 func setgroups(ngid int, gid *_Gid_t) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procsetgroups)), 2, uintptr(ngid), uintptr(unsafe.Pointer(gid)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -503,7 +503,7 @@ func wait4(pid int32, statusp *_C_int, options int, rusage *Rusage) (wpid int32,
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procwait4)), 4, uintptr(pid), uintptr(unsafe.Pointer(statusp)), uintptr(options), uintptr(unsafe.Pointer(rusage)), 0, 0)
 	wpid = int32(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -518,7 +518,7 @@ func gethostname(buf []byte) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procgethostname)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(len(buf)), 0, 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -533,7 +533,7 @@ func utimes(path string, times *[2]Timeval) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procutimes)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -548,7 +548,7 @@ func utimensat(fd int, path string, times *[2]Timespec, flag int) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procutimensat)), 4, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(times)), uintptr(flag), 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -559,7 +559,7 @@ func fcntl(fd int, cmd int, arg int) (val int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procfcntl)), 3, uintptr(fd), uintptr(cmd), uintptr(arg), 0, 0, 0)
 	val = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -569,7 +569,7 @@ func fcntl(fd int, cmd int, arg int) (val int, err error) {
 func futimesat(fildes int, path *byte, times *[2]Timeval) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procfutimesat)), 3, uintptr(fildes), uintptr(unsafe.Pointer(path)), uintptr(unsafe.Pointer(times)), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -580,7 +580,7 @@ func accept(s int, rsa *RawSockaddrAny, addrlen *_Socklen) (fd int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procaccept)), 3, uintptr(s), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), 0, 0, 0)
 	fd = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -591,7 +591,7 @@ func recvmsg(s int, msg *Msghdr, flags int) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&proc__xnet_recvmsg)), 3, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags), 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -602,7 +602,7 @@ func sendmsg(s int, msg *Msghdr, flags int) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&proc__xnet_sendmsg)), 3, uintptr(s), uintptr(unsafe.Pointer(msg)), uintptr(flags), 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -612,7 +612,7 @@ func sendmsg(s int, msg *Msghdr, flags int) (n int, err error) {
 func acct(path *byte) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procacct)), 1, uintptr(unsafe.Pointer(path)), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -647,7 +647,7 @@ func ioctlRet(fd int, req int, arg uintptr) (ret int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procioctl)), 3, uintptr(fd), uintptr(req), uintptr(arg), 0, 0, 0)
 	ret = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -658,7 +658,7 @@ func ioctlPtrRet(fd int, req int, arg unsafe.Pointer) (ret int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procioctl)), 3, uintptr(fd), uintptr(req), uintptr(arg), 0, 0, 0)
 	ret = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -669,7 +669,7 @@ func poll(fds *PollFd, nfds int, timeout int) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procpoll)), 3, uintptr(unsafe.Pointer(fds)), uintptr(nfds), uintptr(timeout), 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -684,7 +684,7 @@ func Access(path string, mode uint32) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procAccess)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -694,7 +694,7 @@ func Access(path string, mode uint32) (err error) {
 func Adjtime(delta *Timeval, olddelta *Timeval) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procAdjtime)), 2, uintptr(unsafe.Pointer(delta)), uintptr(unsafe.Pointer(olddelta)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -709,7 +709,7 @@ func Chdir(path string) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procChdir)), 1, uintptr(unsafe.Pointer(_p0)), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -724,7 +724,7 @@ func Chmod(path string, mode uint32) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procChmod)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -739,7 +739,7 @@ func Chown(path string, uid int, gid int) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procChown)), 3, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -754,7 +754,7 @@ func Chroot(path string) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procChroot)), 1, uintptr(unsafe.Pointer(_p0)), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -764,7 +764,7 @@ func Chroot(path string) (err error) {
 func ClockGettime(clockid int32, time *Timespec) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procClockGettime)), 2, uintptr(clockid), uintptr(unsafe.Pointer(time)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -774,7 +774,7 @@ func ClockGettime(clockid int32, time *Timespec) (err error) {
 func Close(fd int) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procClose)), 1, uintptr(fd), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -790,7 +790,7 @@ func Creat(path string, mode uint32) (fd int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procCreat)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0, 0, 0, 0)
 	fd = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -801,7 +801,7 @@ func Dup(fd int) (nfd int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procDup)), 1, uintptr(fd), 0, 0, 0, 0, 0)
 	nfd = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -811,7 +811,7 @@ func Dup(fd int) (nfd int, err error) {
 func Dup2(oldfd int, newfd int) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procDup2)), 2, uintptr(oldfd), uintptr(newfd), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -833,7 +833,7 @@ func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procFaccessat)), 4, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -843,7 +843,7 @@ func Faccessat(dirfd int, path string, mode uint32, flags int) (err error) {
 func Fchdir(fd int) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procFchdir)), 1, uintptr(fd), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -853,7 +853,7 @@ func Fchdir(fd int) (err error) {
 func Fchmod(fd int, mode uint32) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procFchmod)), 2, uintptr(fd), uintptr(mode), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -868,7 +868,7 @@ func Fchmodat(dirfd int, path string, mode uint32, flags int) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procFchmodat)), 4, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(flags), 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -878,7 +878,7 @@ func Fchmodat(dirfd int, path string, mode uint32, flags int) (err error) {
 func Fchown(fd int, uid int, gid int) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procFchown)), 3, uintptr(fd), uintptr(uid), uintptr(gid), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -893,7 +893,7 @@ func Fchownat(dirfd int, path string, uid int, gid int, flags int) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procFchownat)), 5, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid), uintptr(flags), 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -903,7 +903,7 @@ func Fchownat(dirfd int, path string, uid int, gid int, flags int) (err error) {
 func Fdatasync(fd int) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procFdatasync)), 1, uintptr(fd), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -913,7 +913,7 @@ func Fdatasync(fd int) (err error) {
 func Flock(fd int, how int) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procFlock)), 2, uintptr(fd), uintptr(how), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -924,7 +924,7 @@ func Fpathconf(fd int, name int) (val int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procFpathconf)), 2, uintptr(fd), uintptr(name), 0, 0, 0, 0)
 	val = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -934,7 +934,7 @@ func Fpathconf(fd int, name int) (val int, err error) {
 func Fstat(fd int, stat *Stat_t) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procFstat)), 2, uintptr(fd), uintptr(unsafe.Pointer(stat)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -949,7 +949,7 @@ func Fstatat(fd int, path string, stat *Stat_t, flags int) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procFstatat)), 4, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), uintptr(flags), 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -959,7 +959,7 @@ func Fstatat(fd int, path string, stat *Stat_t, flags int) (err error) {
 func Fstatvfs(fd int, vfsstat *Statvfs_t) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procFstatvfs)), 2, uintptr(fd), uintptr(unsafe.Pointer(vfsstat)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -974,7 +974,7 @@ func Getdents(fd int, buf []byte, basep *uintptr) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procGetdents)), 4, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(len(buf)), uintptr(unsafe.Pointer(basep)), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1001,7 +1001,7 @@ func Getpgid(pid int) (pgid int, err error) {
 	r0, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procGetpgid)), 1, uintptr(pid), 0, 0, 0, 0, 0)
 	pgid = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1012,7 +1012,7 @@ func Getpgrp() (pgid int, err error) {
 	r0, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procGetpgrp)), 0, 0, 0, 0, 0, 0, 0)
 	pgid = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1047,7 +1047,7 @@ func Getpriority(which int, who int) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procGetpriority)), 2, uintptr(which), uintptr(who), 0, 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1057,7 +1057,7 @@ func Getpriority(which int, who int) (n int, err error) {
 func Getrlimit(which int, lim *Rlimit) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procGetrlimit)), 2, uintptr(which), uintptr(unsafe.Pointer(lim)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1067,7 +1067,7 @@ func Getrlimit(which int, lim *Rlimit) (err error) {
 func Getrusage(who int, rusage *Rusage) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procGetrusage)), 2, uintptr(who), uintptr(unsafe.Pointer(rusage)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1078,7 +1078,7 @@ func Getsid(pid int) (sid int, err error) {
 	r0, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procGetsid)), 1, uintptr(pid), 0, 0, 0, 0, 0)
 	sid = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1088,7 +1088,7 @@ func Getsid(pid int) (sid int, err error) {
 func Gettimeofday(tv *Timeval) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procGettimeofday)), 1, uintptr(unsafe.Pointer(tv)), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1106,7 +1106,7 @@ func Getuid() (uid int) {
 func Kill(pid int, signum syscall.Signal) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procKill)), 2, uintptr(pid), uintptr(signum), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1121,7 +1121,7 @@ func Lchown(path string, uid int, gid int) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procLchown)), 3, uintptr(unsafe.Pointer(_p0)), uintptr(uid), uintptr(gid), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1141,7 +1141,7 @@ func Link(path string, link string) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procLink)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1151,7 +1151,7 @@ func Link(path string, link string) (err error) {
 func Listen(s int, backlog int) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&proc__xnet_llisten)), 2, uintptr(s), uintptr(backlog), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1166,7 +1166,7 @@ func Lstat(path string, stat *Stat_t) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procLstat)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1180,7 +1180,7 @@ func Madvise(b []byte, advice int) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procMadvise)), 3, uintptr(unsafe.Pointer(_p0)), uintptr(len(b)), uintptr(advice), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1195,7 +1195,7 @@ func Mkdir(path string, mode uint32) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procMkdir)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1210,7 +1210,7 @@ func Mkdirat(dirfd int, path string, mode uint32) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procMkdirat)), 3, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1225,7 +1225,7 @@ func Mkfifo(path string, mode uint32) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procMkfifo)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1240,7 +1240,7 @@ func Mkfifoat(dirfd int, path string, mode uint32) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procMkfifoat)), 3, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1255,7 +1255,7 @@ func Mknod(path string, mode uint32, dev int) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procMknod)), 3, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1270,7 +1270,7 @@ func Mknodat(dirfd int, path string, mode uint32, dev int) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procMknodat)), 4, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(dev), 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1284,7 +1284,7 @@ func Mlock(b []byte) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procMlock)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(len(b)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1294,7 +1294,7 @@ func Mlock(b []byte) (err error) {
 func Mlockall(flags int) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procMlockall)), 1, uintptr(flags), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1308,7 +1308,7 @@ func Mprotect(b []byte, prot int) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procMprotect)), 3, uintptr(unsafe.Pointer(_p0)), uintptr(len(b)), uintptr(prot), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1322,7 +1322,7 @@ func Msync(b []byte, flags int) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procMsync)), 3, uintptr(unsafe.Pointer(_p0)), uintptr(len(b)), uintptr(flags), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1336,7 +1336,7 @@ func Munlock(b []byte) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procMunlock)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(len(b)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1346,7 +1346,7 @@ func Munlock(b []byte) (err error) {
 func Munlockall() (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procMunlockall)), 0, 0, 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1356,7 +1356,7 @@ func Munlockall() (err error) {
 func Nanosleep(time *Timespec, leftover *Timespec) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procNanosleep)), 2, uintptr(unsafe.Pointer(time)), uintptr(unsafe.Pointer(leftover)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1372,7 +1372,7 @@ func Open(path string, mode int, perm uint32) (fd int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procOpen)), 3, uintptr(unsafe.Pointer(_p0)), uintptr(mode), uintptr(perm), 0, 0, 0)
 	fd = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1388,7 +1388,7 @@ func Openat(dirfd int, path string, flags int, mode uint32) (fd int, err error)
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procOpenat)), 4, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(flags), uintptr(mode), 0, 0)
 	fd = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1404,7 +1404,7 @@ func Pathconf(path string, name int) (val int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procPathconf)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(name), 0, 0, 0, 0)
 	val = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1414,7 +1414,7 @@ func Pathconf(path string, name int) (val int, err error) {
 func Pause() (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procPause)), 0, 0, 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1429,7 +1429,7 @@ func pread(fd int, p []byte, offset int64) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procpread)), 4, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(len(p)), uintptr(offset), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1444,7 +1444,7 @@ func pwrite(fd int, p []byte, offset int64) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procpwrite)), 4, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(len(p)), uintptr(offset), 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1459,7 +1459,7 @@ func read(fd int, p []byte) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procread)), 3, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(len(p)), 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1479,7 +1479,7 @@ func Readlink(path string, buf []byte) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procReadlink)), 3, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), uintptr(len(buf)), 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1499,7 +1499,7 @@ func Rename(from string, to string) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procRename)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1519,7 +1519,7 @@ func Renameat(olddirfd int, oldpath string, newdirfd int, newpath string) (err e
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procRenameat)), 4, uintptr(olddirfd), uintptr(unsafe.Pointer(_p0)), uintptr(newdirfd), uintptr(unsafe.Pointer(_p1)), 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1534,7 +1534,7 @@ func Rmdir(path string) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procRmdir)), 1, uintptr(unsafe.Pointer(_p0)), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1545,7 +1545,7 @@ func Seek(fd int, offset int64, whence int) (newoffset int64, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&proclseek)), 3, uintptr(fd), uintptr(offset), uintptr(whence), 0, 0, 0)
 	newoffset = int64(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1556,7 +1556,7 @@ func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procSelect)), 5, uintptr(nfd), uintptr(unsafe.Pointer(r)), uintptr(unsafe.Pointer(w)), uintptr(unsafe.Pointer(e)), uintptr(unsafe.Pointer(timeout)), 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1566,7 +1566,7 @@ func Select(nfd int, r *FdSet, w *FdSet, e *FdSet, timeout *Timeval) (n int, err
 func Setegid(egid int) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procSetegid)), 1, uintptr(egid), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1576,7 +1576,7 @@ func Setegid(egid int) (err error) {
 func Seteuid(euid int) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procSeteuid)), 1, uintptr(euid), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1586,7 +1586,7 @@ func Seteuid(euid int) (err error) {
 func Setgid(gid int) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procSetgid)), 1, uintptr(gid), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1600,7 +1600,7 @@ func Sethostname(p []byte) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procSethostname)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(len(p)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1610,7 +1610,7 @@ func Sethostname(p []byte) (err error) {
 func Setpgid(pid int, pgid int) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procSetpgid)), 2, uintptr(pid), uintptr(pgid), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1620,7 +1620,7 @@ func Setpgid(pid int, pgid int) (err error) {
 func Setpriority(which int, who int, prio int) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procSetpriority)), 3, uintptr(which), uintptr(who), uintptr(prio), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1630,7 +1630,7 @@ func Setpriority(which int, who int, prio int) (err error) {
 func Setregid(rgid int, egid int) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procSetregid)), 2, uintptr(rgid), uintptr(egid), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1640,7 +1640,7 @@ func Setregid(rgid int, egid int) (err error) {
 func Setreuid(ruid int, euid int) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procSetreuid)), 2, uintptr(ruid), uintptr(euid), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1651,7 +1651,7 @@ func Setsid() (pid int, err error) {
 	r0, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procSetsid)), 0, 0, 0, 0, 0, 0, 0)
 	pid = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1661,7 +1661,7 @@ func Setsid() (pid int, err error) {
 func Setuid(uid int) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procSetuid)), 1, uintptr(uid), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1671,7 +1671,7 @@ func Setuid(uid int) (err error) {
 func Shutdown(s int, how int) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procshutdown)), 2, uintptr(s), uintptr(how), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1686,7 +1686,7 @@ func Stat(path string, stat *Stat_t) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procStat)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(stat)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1701,7 +1701,7 @@ func Statvfs(path string, vfsstat *Statvfs_t) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procStatvfs)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(vfsstat)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1721,7 +1721,7 @@ func Symlink(path string, link string) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procSymlink)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(_p1)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1731,7 +1731,7 @@ func Symlink(path string, link string) (err error) {
 func Sync() (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procSync)), 0, 0, 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1742,7 +1742,7 @@ func Sysconf(which int) (n int64, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procSysconf)), 1, uintptr(which), 0, 0, 0, 0, 0)
 	n = int64(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1753,7 +1753,7 @@ func Times(tms *Tms) (ticks uintptr, err error) {
 	r0, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procTimes)), 1, uintptr(unsafe.Pointer(tms)), 0, 0, 0, 0, 0)
 	ticks = uintptr(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1768,7 +1768,7 @@ func Truncate(path string, length int64) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procTruncate)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(length), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1778,7 +1778,7 @@ func Truncate(path string, length int64) (err error) {
 func Fsync(fd int) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procFsync)), 1, uintptr(fd), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1788,7 +1788,7 @@ func Fsync(fd int) (err error) {
 func Ftruncate(fd int, length int64) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procFtruncate)), 2, uintptr(fd), uintptr(length), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1806,7 +1806,7 @@ func Umask(mask int) (oldmask int) {
 func Uname(buf *Utsname) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procUname)), 1, uintptr(unsafe.Pointer(buf)), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1821,7 +1821,7 @@ func Unmount(target string, flags int) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procumount)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1836,7 +1836,7 @@ func Unlink(path string) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procUnlink)), 1, uintptr(unsafe.Pointer(_p0)), 0, 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1851,7 +1851,7 @@ func Unlinkat(dirfd int, path string, flags int) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procUnlinkat)), 3, uintptr(dirfd), uintptr(unsafe.Pointer(_p0)), uintptr(flags), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1861,7 +1861,7 @@ func Unlinkat(dirfd int, path string, flags int) (err error) {
 func Ustat(dev int, ubuf *Ustat_t) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procUstat)), 2, uintptr(dev), uintptr(unsafe.Pointer(ubuf)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1876,7 +1876,7 @@ func Utime(path string, buf *Utimbuf) (err error) {
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procUtime)), 2, uintptr(unsafe.Pointer(_p0)), uintptr(unsafe.Pointer(buf)), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1886,7 +1886,7 @@ func Utime(path string, buf *Utimbuf) (err error) {
 func bind(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&proc__xnet_bind)), 3, uintptr(s), uintptr(addr), uintptr(addrlen), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1896,7 +1896,7 @@ func bind(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) {
 func connect(s int, addr unsafe.Pointer, addrlen _Socklen) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&proc__xnet_connect)), 3, uintptr(s), uintptr(addr), uintptr(addrlen), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1907,7 +1907,7 @@ func mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procmmap)), 6, uintptr(addr), uintptr(length), uintptr(prot), uintptr(flag), uintptr(fd), uintptr(pos))
 	ret = uintptr(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1917,7 +1917,7 @@ func mmap(addr uintptr, length uintptr, prot int, flag int, fd int, pos int64) (
 func munmap(addr uintptr, length uintptr) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procmunmap)), 2, uintptr(addr), uintptr(length), 0, 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1928,7 +1928,7 @@ func sendfile(outfd int, infd int, offset *int64, count int) (written int, err e
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procsendfile)), 4, uintptr(outfd), uintptr(infd), uintptr(unsafe.Pointer(offset)), uintptr(count), 0, 0)
 	written = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1942,7 +1942,7 @@ func sendto(s int, buf []byte, flags int, to unsafe.Pointer, addrlen _Socklen) (
 	}
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&proc__xnet_sendto)), 6, uintptr(s), uintptr(unsafe.Pointer(_p0)), uintptr(len(buf)), uintptr(flags), uintptr(to), uintptr(addrlen))
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1953,7 +1953,7 @@ func socket(domain int, typ int, proto int) (fd int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&proc__xnet_socket)), 3, uintptr(domain), uintptr(typ), uintptr(proto), 0, 0, 0)
 	fd = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1963,7 +1963,7 @@ func socket(domain int, typ int, proto int) (fd int, err error) {
 func socketpair(domain int, typ int, proto int, fd *[2]int32) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&proc__xnet_socketpair)), 4, uintptr(domain), uintptr(typ), uintptr(proto), uintptr(unsafe.Pointer(fd)), 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1978,7 +1978,7 @@ func write(fd int, p []byte) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procwrite)), 3, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(len(p)), 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1988,7 +1988,7 @@ func write(fd int, p []byte) (n int, err error) {
 func getsockopt(s int, level int, name int, val unsafe.Pointer, vallen *_Socklen) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&proc__xnet_getsockopt)), 5, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(unsafe.Pointer(vallen)), 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -1998,7 +1998,7 @@ func getsockopt(s int, level int, name int, val unsafe.Pointer, vallen *_Socklen
 func getpeername(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) {
 	_, _, e1 := rawSysvicall6(uintptr(unsafe.Pointer(&procgetpeername)), 3, uintptr(fd), uintptr(unsafe.Pointer(rsa)), uintptr(unsafe.Pointer(addrlen)), 0, 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -2008,7 +2008,7 @@ func getpeername(fd int, rsa *RawSockaddrAny, addrlen *_Socklen) (err error) {
 func setsockopt(s int, level int, name int, val unsafe.Pointer, vallen uintptr) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procsetsockopt)), 5, uintptr(s), uintptr(level), uintptr(name), uintptr(val), uintptr(vallen), 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -2023,7 +2023,7 @@ func recvfrom(fd int, p []byte, flags int, from *RawSockaddrAny, fromlen *_Sockl
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procrecvfrom)), 6, uintptr(fd), uintptr(unsafe.Pointer(_p0)), uintptr(len(p)), uintptr(flags), uintptr(unsafe.Pointer(from)), uintptr(unsafe.Pointer(fromlen)))
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -2034,7 +2034,7 @@ func port_create() (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procport_create)), 0, 0, 0, 0, 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -2045,7 +2045,7 @@ func port_associate(port int, source int, object uintptr, events int, user *byte
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procport_associate)), 5, uintptr(port), uintptr(source), uintptr(object), uintptr(events), uintptr(unsafe.Pointer(user)), 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -2056,7 +2056,7 @@ func port_dissociate(port int, source int, object uintptr) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procport_dissociate)), 3, uintptr(port), uintptr(source), uintptr(object), 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -2067,7 +2067,7 @@ func port_get(port int, pe *portEvent, timeout *Timespec) (n int, err error) {
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procport_get)), 3, uintptr(port), uintptr(unsafe.Pointer(pe)), uintptr(unsafe.Pointer(timeout)), 0, 0, 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -2078,7 +2078,7 @@ func port_getn(port int, pe *portEvent, max uint32, nget *uint32, timeout *Times
 	r0, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procport_getn)), 5, uintptr(port), uintptr(unsafe.Pointer(pe)), uintptr(max), uintptr(unsafe.Pointer(nget)), uintptr(unsafe.Pointer(timeout)), 0)
 	n = int(r0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -2088,7 +2088,7 @@ func port_getn(port int, pe *portEvent, max uint32, nget *uint32, timeout *Times
 func putmsg(fd int, clptr *strbuf, dataptr *strbuf, flags int) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procputmsg)), 4, uintptr(fd), uintptr(unsafe.Pointer(clptr)), uintptr(unsafe.Pointer(dataptr)), uintptr(flags), 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
@@ -2098,7 +2098,7 @@ func putmsg(fd int, clptr *strbuf, dataptr *strbuf, flags int) (err error) {
 func getmsg(fd int, clptr *strbuf, dataptr *strbuf, flags *int) (err error) {
 	_, _, e1 := sysvicall6(uintptr(unsafe.Pointer(&procgetmsg)), 4, uintptr(fd), uintptr(unsafe.Pointer(clptr)), uintptr(unsafe.Pointer(dataptr)), uintptr(unsafe.Pointer(flags)), 0, 0)
 	if e1 != 0 {
-		err = e1
+		err = errnoErr(e1)
 	}
 	return
 }
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_zos_s390x.go b/vendor/golang.org/x/sys/unix/zsyscall_zos_s390x.go
index c31681743..1d8fe1d4b 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_zos_s390x.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_zos_s390x.go
@@ -40,17 +40,6 @@ func read(fd int, p []byte) (n int, err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func readlen(fd int, buf *byte, nbuf int) (n int, err error) {
-	r0, _, e1 := syscall_syscall(SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(buf)), uintptr(nbuf))
-	n = int(r0)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func write(fd int, p []byte) (n int, err error) {
 	var _p0 unsafe.Pointer
 	if len(p) > 0 {
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_386.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_386.go
index c9c4ad031..9862853d3 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_386.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_386.go
@@ -447,4 +447,5 @@ const (
 	SYS_PROCESS_MRELEASE             = 448
 	SYS_FUTEX_WAITV                  = 449
 	SYS_SET_MEMPOLICY_HOME_NODE      = 450
+	SYS_CACHESTAT                    = 451
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_amd64.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_amd64.go
index 12ff3417c..8901f0f4e 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_amd64.go
@@ -369,4 +369,5 @@ const (
 	SYS_PROCESS_MRELEASE        = 448
 	SYS_FUTEX_WAITV             = 449
 	SYS_SET_MEMPOLICY_HOME_NODE = 450
+	SYS_CACHESTAT               = 451
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_arm.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_arm.go
index c3fb5e77a..6902c37ee 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_arm.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_arm.go
@@ -411,4 +411,5 @@ const (
 	SYS_PROCESS_MRELEASE             = 448
 	SYS_FUTEX_WAITV                  = 449
 	SYS_SET_MEMPOLICY_HOME_NODE      = 450
+	SYS_CACHESTAT                    = 451
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_arm64.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_arm64.go
index 358c847a4..a6d3dff81 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_arm64.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_arm64.go
@@ -314,4 +314,5 @@ const (
 	SYS_PROCESS_MRELEASE        = 448
 	SYS_FUTEX_WAITV             = 449
 	SYS_SET_MEMPOLICY_HOME_NODE = 450
+	SYS_CACHESTAT               = 451
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_loong64.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_loong64.go
index 81c4849b1..b18f3f710 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_loong64.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_loong64.go
@@ -308,4 +308,5 @@ const (
 	SYS_PROCESS_MRELEASE        = 448
 	SYS_FUTEX_WAITV             = 449
 	SYS_SET_MEMPOLICY_HOME_NODE = 450
+	SYS_CACHESTAT               = 451
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_mips.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_mips.go
index 202a57e90..0302e5e3d 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_mips.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_mips.go
@@ -431,4 +431,5 @@ const (
 	SYS_PROCESS_MRELEASE             = 4448
 	SYS_FUTEX_WAITV                  = 4449
 	SYS_SET_MEMPOLICY_HOME_NODE      = 4450
+	SYS_CACHESTAT                    = 4451
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64.go
index 1fbceb52d..6693ba4a0 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64.go
@@ -361,4 +361,5 @@ const (
 	SYS_PROCESS_MRELEASE        = 5448
 	SYS_FUTEX_WAITV             = 5449
 	SYS_SET_MEMPOLICY_HOME_NODE = 5450
+	SYS_CACHESTAT               = 5451
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64le.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64le.go
index b4ffb7a20..fd93f4987 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64le.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_mips64le.go
@@ -361,4 +361,5 @@ const (
 	SYS_PROCESS_MRELEASE        = 5448
 	SYS_FUTEX_WAITV             = 5449
 	SYS_SET_MEMPOLICY_HOME_NODE = 5450
+	SYS_CACHESTAT               = 5451
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_mipsle.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_mipsle.go
index 867985f9b..760ddcadc 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_mipsle.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_mipsle.go
@@ -431,4 +431,5 @@ const (
 	SYS_PROCESS_MRELEASE             = 4448
 	SYS_FUTEX_WAITV                  = 4449
 	SYS_SET_MEMPOLICY_HOME_NODE      = 4450
+	SYS_CACHESTAT                    = 4451
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc.go
index a8cce69ed..cff2b2555 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc.go
@@ -438,4 +438,5 @@ const (
 	SYS_PROCESS_MRELEASE             = 448
 	SYS_FUTEX_WAITV                  = 449
 	SYS_SET_MEMPOLICY_HOME_NODE      = 450
+	SYS_CACHESTAT                    = 451
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64.go
index d44c5b39d..a4b2405d0 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64.go
@@ -410,4 +410,5 @@ const (
 	SYS_PROCESS_MRELEASE        = 448
 	SYS_FUTEX_WAITV             = 449
 	SYS_SET_MEMPOLICY_HOME_NODE = 450
+	SYS_CACHESTAT               = 451
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64le.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64le.go
index 4214dd9c0..aca54b4e3 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64le.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_ppc64le.go
@@ -410,4 +410,5 @@ const (
 	SYS_PROCESS_MRELEASE        = 448
 	SYS_FUTEX_WAITV             = 449
 	SYS_SET_MEMPOLICY_HOME_NODE = 450
+	SYS_CACHESTAT               = 451
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.go
index ef285c567..9d1738d64 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_riscv64.go
@@ -315,4 +315,5 @@ const (
 	SYS_PROCESS_MRELEASE        = 448
 	SYS_FUTEX_WAITV             = 449
 	SYS_SET_MEMPOLICY_HOME_NODE = 450
+	SYS_CACHESTAT               = 451
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_s390x.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_s390x.go
index e6ed7d637..022878dc8 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_s390x.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_s390x.go
@@ -376,4 +376,5 @@ const (
 	SYS_PROCESS_MRELEASE        = 448
 	SYS_FUTEX_WAITV             = 449
 	SYS_SET_MEMPOLICY_HOME_NODE = 450
+	SYS_CACHESTAT               = 451
 )
diff --git a/vendor/golang.org/x/sys/unix/zsysnum_linux_sparc64.go b/vendor/golang.org/x/sys/unix/zsysnum_linux_sparc64.go
index 92f628ef4..4100a761c 100644
--- a/vendor/golang.org/x/sys/unix/zsysnum_linux_sparc64.go
+++ b/vendor/golang.org/x/sys/unix/zsysnum_linux_sparc64.go
@@ -389,4 +389,5 @@ const (
 	SYS_PROCESS_MRELEASE        = 448
 	SYS_FUTEX_WAITV             = 449
 	SYS_SET_MEMPOLICY_HOME_NODE = 450
+	SYS_CACHESTAT               = 451
 )
diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux.go b/vendor/golang.org/x/sys/unix/ztypes_linux.go
index 494493c78..18aa70b42 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_linux.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux.go
@@ -1977,7 +1977,7 @@ const (
 	NFT_MSG_GETFLOWTABLE              = 0x17
 	NFT_MSG_DELFLOWTABLE              = 0x18
 	NFT_MSG_GETRULE_RESET             = 0x19
-	NFT_MSG_MAX                       = 0x21
+	NFT_MSG_MAX                       = 0x22
 	NFTA_LIST_UNSPEC                  = 0x0
 	NFTA_LIST_ELEM                    = 0x1
 	NFTA_HOOK_UNSPEC                  = 0x0
@@ -4499,7 +4499,7 @@ const (
 	NL80211_ATTR_MAC_HINT                                   = 0xc8
 	NL80211_ATTR_MAC_MASK                                   = 0xd7
 	NL80211_ATTR_MAX_AP_ASSOC_STA                           = 0xca
-	NL80211_ATTR_MAX                                        = 0x145
+	NL80211_ATTR_MAX                                        = 0x146
 	NL80211_ATTR_MAX_CRIT_PROT_DURATION                     = 0xb4
 	NL80211_ATTR_MAX_CSA_COUNTERS                           = 0xce
 	NL80211_ATTR_MAX_MATCH_SETS                             = 0x85
@@ -4869,7 +4869,7 @@ const (
 	NL80211_CMD_LEAVE_IBSS                                  = 0x2c
 	NL80211_CMD_LEAVE_MESH                                  = 0x45
 	NL80211_CMD_LEAVE_OCB                                   = 0x6d
-	NL80211_CMD_MAX                                         = 0x99
+	NL80211_CMD_MAX                                         = 0x9a
 	NL80211_CMD_MICHAEL_MIC_FAILURE                         = 0x29
 	NL80211_CMD_MODIFY_LINK_STA                             = 0x97
 	NL80211_CMD_NAN_MATCH                                   = 0x78
@@ -5503,7 +5503,7 @@ const (
 	NL80211_RATE_INFO_HE_RU_ALLOC_52                        = 0x1
 	NL80211_RATE_INFO_HE_RU_ALLOC_996                       = 0x5
 	NL80211_RATE_INFO_HE_RU_ALLOC                           = 0x11
-	NL80211_RATE_INFO_MAX                                   = 0x16
+	NL80211_RATE_INFO_MAX                                   = 0x1d
 	NL80211_RATE_INFO_MCS                                   = 0x2
 	NL80211_RATE_INFO_SHORT_GI                              = 0x4
 	NL80211_RATE_INFO_VHT_MCS                               = 0x6
diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go b/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go
index 83c69c119..1b4c97c32 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux_riscv64.go
@@ -733,6 +733,10 @@ const (
 	RISCV_HWPROBE_KEY_IMA_EXT_0          = 0x4
 	RISCV_HWPROBE_IMA_FD                 = 0x1
 	RISCV_HWPROBE_IMA_C                  = 0x2
+	RISCV_HWPROBE_IMA_V                  = 0x4
+	RISCV_HWPROBE_EXT_ZBA                = 0x8
+	RISCV_HWPROBE_EXT_ZBB                = 0x10
+	RISCV_HWPROBE_EXT_ZBS                = 0x20
 	RISCV_HWPROBE_KEY_CPUPERF_0          = 0x5
 	RISCV_HWPROBE_MISALIGNED_UNKNOWN     = 0x0
 	RISCV_HWPROBE_MISALIGNED_EMULATED    = 0x1
diff --git a/vendor/golang.org/x/sys/windows/exec_windows.go b/vendor/golang.org/x/sys/windows/exec_windows.go
index a52e0331d..9cabbb694 100644
--- a/vendor/golang.org/x/sys/windows/exec_windows.go
+++ b/vendor/golang.org/x/sys/windows/exec_windows.go
@@ -22,7 +22,7 @@ import (
 //     but only if there is space or tab inside s.
 func EscapeArg(s string) string {
 	if len(s) == 0 {
-		return "\"\""
+		return `""`
 	}
 	n := len(s)
 	hasSpace := false
@@ -35,7 +35,7 @@ func EscapeArg(s string) string {
 		}
 	}
 	if hasSpace {
-		n += 2
+		n += 2 // Reserve space for quotes.
 	}
 	if n == len(s) {
 		return s
@@ -82,20 +82,68 @@ func EscapeArg(s string) string {
 // in CreateProcess's CommandLine argument, CreateService/ChangeServiceConfig's BinaryPathName argument,
 // or any program that uses CommandLineToArgv.
 func ComposeCommandLine(args []string) string {
-	var commandLine string
-	for i := range args {
-		if i > 0 {
-			commandLine += " "
+	if len(args) == 0 {
+		return ""
+	}
+
+	// Per https://learn.microsoft.com/en-us/windows/win32/api/shellapi/nf-shellapi-commandlinetoargvw:
+	// “This function accepts command lines that contain a program name; the
+	// program name can be enclosed in quotation marks or not.”
+	//
+	// Unfortunately, it provides no means of escaping interior quotation marks
+	// within that program name, and we have no way to report them here.
+	prog := args[0]
+	mustQuote := len(prog) == 0
+	for i := 0; i < len(prog); i++ {
+		c := prog[i]
+		if c <= ' ' || (c == '"' && i == 0) {
+			// Force quotes for not only the ASCII space and tab as described in the
+			// MSDN article, but also ASCII control characters.
+			// The documentation for CommandLineToArgvW doesn't say what happens when
+			// the first argument is not a valid program name, but it empirically
+			// seems to drop unquoted control characters.
+			mustQuote = true
+			break
+		}
+	}
+	var commandLine []byte
+	if mustQuote {
+		commandLine = make([]byte, 0, len(prog)+2)
+		commandLine = append(commandLine, '"')
+		for i := 0; i < len(prog); i++ {
+			c := prog[i]
+			if c == '"' {
+				// This quote would interfere with our surrounding quotes.
+				// We have no way to report an error, so just strip out
+				// the offending character instead.
+				continue
+			}
+			commandLine = append(commandLine, c)
 		}
-		commandLine += EscapeArg(args[i])
+		commandLine = append(commandLine, '"')
+	} else {
+		if len(args) == 1 {
+			// args[0] is a valid command line representing itself.
+			// No need to allocate a new slice or string for it.
+			return prog
+		}
+		commandLine = []byte(prog)
 	}
-	return commandLine
+
+	for _, arg := range args[1:] {
+		commandLine = append(commandLine, ' ')
+		// TODO(bcmills): since we're already appending to a slice, it would be nice
+		// to avoid the intermediate allocations of EscapeArg.
+		// Perhaps we can factor out an appendEscapedArg function.
+		commandLine = append(commandLine, EscapeArg(arg)...)
+	}
+	return string(commandLine)
 }
 
 // DecomposeCommandLine breaks apart its argument command line into unescaped parts using CommandLineToArgv,
 // as gathered from GetCommandLine, QUERY_SERVICE_CONFIG's BinaryPathName argument, or elsewhere that
 // command lines are passed around.
-// DecomposeCommandLine returns error if commandLine contains NUL.
+// DecomposeCommandLine returns an error if commandLine contains NUL.
 func DecomposeCommandLine(commandLine string) ([]string, error) {
 	if len(commandLine) == 0 {
 		return []string{}, nil
@@ -105,18 +153,35 @@ func DecomposeCommandLine(commandLine string) ([]string, error) {
 		return nil, errorspkg.New("string with NUL passed to DecomposeCommandLine")
 	}
 	var argc int32
-	argv, err := CommandLineToArgv(&utf16CommandLine[0], &argc)
+	argv, err := commandLineToArgv(&utf16CommandLine[0], &argc)
 	if err != nil {
 		return nil, err
 	}
 	defer LocalFree(Handle(unsafe.Pointer(argv)))
+
 	var args []string
-	for _, v := range (*argv)[:argc] {
-		args = append(args, UTF16ToString((*v)[:]))
+	for _, p := range unsafe.Slice(argv, argc) {
+		args = append(args, UTF16PtrToString(p))
 	}
 	return args, nil
 }
 
+// CommandLineToArgv parses a Unicode command line string and sets
+// argc to the number of parsed arguments.
+//
+// The returned memory should be freed using a single call to LocalFree.
+//
+// Note that although the return type of CommandLineToArgv indicates 8192
+// entries of up to 8192 characters each, the actual count of parsed arguments
+// may exceed 8192, and the documentation for CommandLineToArgvW does not mention
+// any bound on the lengths of the individual argument strings.
+// (See https://go.dev/issue/63236.)
+func CommandLineToArgv(cmd *uint16, argc *int32) (argv *[8192]*[8192]uint16, err error) {
+	argp, err := commandLineToArgv(cmd, argc)
+	argv = (*[8192]*[8192]uint16)(unsafe.Pointer(argp))
+	return argv, err
+}
+
 func CloseOnExec(fd Handle) {
 	SetHandleInformation(Handle(fd), HANDLE_FLAG_INHERIT, 0)
 }
diff --git a/vendor/golang.org/x/sys/windows/security_windows.go b/vendor/golang.org/x/sys/windows/security_windows.go
index d414ef13b..26be94a8a 100644
--- a/vendor/golang.org/x/sys/windows/security_windows.go
+++ b/vendor/golang.org/x/sys/windows/security_windows.go
@@ -7,8 +7,6 @@ package windows
 import (
 	"syscall"
 	"unsafe"
-
-	"golang.org/x/sys/internal/unsafeheader"
 )
 
 const (
@@ -1341,21 +1339,14 @@ func (selfRelativeSD *SECURITY_DESCRIPTOR) copySelfRelativeSecurityDescriptor()
 		sdLen = min
 	}
 
-	var src []byte
-	h := (*unsafeheader.Slice)(unsafe.Pointer(&src))
-	h.Data = unsafe.Pointer(selfRelativeSD)
-	h.Len = sdLen
-	h.Cap = sdLen
-
+	src := unsafe.Slice((*byte)(unsafe.Pointer(selfRelativeSD)), sdLen)
+	// SECURITY_DESCRIPTOR has pointers in it, which means checkptr expects for it to
+	// be aligned properly. When we're copying a Windows-allocated struct to a
+	// Go-allocated one, make sure that the Go allocation is aligned to the
+	// pointer size.
 	const psize = int(unsafe.Sizeof(uintptr(0)))
-
-	var dst []byte
-	h = (*unsafeheader.Slice)(unsafe.Pointer(&dst))
 	alloc := make([]uintptr, (sdLen+psize-1)/psize)
-	h.Data = (*unsafeheader.Slice)(unsafe.Pointer(&alloc)).Data
-	h.Len = sdLen
-	h.Cap = sdLen
-
+	dst := unsafe.Slice((*byte)(unsafe.Pointer(&alloc[0])), sdLen)
 	copy(dst, src)
 	return (*SECURITY_DESCRIPTOR)(unsafe.Pointer(&dst[0]))
 }
diff --git a/vendor/golang.org/x/sys/windows/syscall_windows.go b/vendor/golang.org/x/sys/windows/syscall_windows.go
index 67bad0926..35cfc57ca 100644
--- a/vendor/golang.org/x/sys/windows/syscall_windows.go
+++ b/vendor/golang.org/x/sys/windows/syscall_windows.go
@@ -15,8 +15,6 @@ import (
 	"time"
 	"unicode/utf16"
 	"unsafe"
-
-	"golang.org/x/sys/internal/unsafeheader"
 )
 
 type Handle uintptr
@@ -240,7 +238,7 @@ func NewCallbackCDecl(fn interface{}) uintptr {
 //sys	SetFileAttributes(name *uint16, attrs uint32) (err error) = kernel32.SetFileAttributesW
 //sys	GetFileAttributesEx(name *uint16, level uint32, info *byte) (err error) = kernel32.GetFileAttributesExW
 //sys	GetCommandLine() (cmd *uint16) = kernel32.GetCommandLineW
-//sys	CommandLineToArgv(cmd *uint16, argc *int32) (argv *[8192]*[8192]uint16, err error) [failretval==nil] = shell32.CommandLineToArgvW
+//sys	commandLineToArgv(cmd *uint16, argc *int32) (argv **uint16, err error) [failretval==nil] = shell32.CommandLineToArgvW
 //sys	LocalFree(hmem Handle) (handle Handle, err error) [failretval!=0]
 //sys	LocalAlloc(flags uint32, length uint32) (ptr uintptr, err error)
 //sys	SetHandleInformation(handle Handle, mask uint32, flags uint32) (err error)
@@ -299,12 +297,15 @@ func NewCallbackCDecl(fn interface{}) uintptr {
 //sys	RegNotifyChangeKeyValue(key Handle, watchSubtree bool, notifyFilter uint32, event Handle, asynchronous bool) (regerrno error) = advapi32.RegNotifyChangeKeyValue
 //sys	GetCurrentProcessId() (pid uint32) = kernel32.GetCurrentProcessId
 //sys	ProcessIdToSessionId(pid uint32, sessionid *uint32) (err error) = kernel32.ProcessIdToSessionId
+//sys	ClosePseudoConsole(console Handle) = kernel32.ClosePseudoConsole
+//sys	createPseudoConsole(size uint32, in Handle, out Handle, flags uint32, pconsole *Handle) (hr error) = kernel32.CreatePseudoConsole
 //sys	GetConsoleMode(console Handle, mode *uint32) (err error) = kernel32.GetConsoleMode
 //sys	SetConsoleMode(console Handle, mode uint32) (err error) = kernel32.SetConsoleMode
 //sys	GetConsoleScreenBufferInfo(console Handle, info *ConsoleScreenBufferInfo) (err error) = kernel32.GetConsoleScreenBufferInfo
 //sys	setConsoleCursorPosition(console Handle, position uint32) (err error) = kernel32.SetConsoleCursorPosition
 //sys	WriteConsole(console Handle, buf *uint16, towrite uint32, written *uint32, reserved *byte) (err error) = kernel32.WriteConsoleW
 //sys	ReadConsole(console Handle, buf *uint16, toread uint32, read *uint32, inputControl *byte) (err error) = kernel32.ReadConsoleW
+//sys	resizePseudoConsole(pconsole Handle, size uint32) (hr error) = kernel32.ResizePseudoConsole
 //sys	CreateToolhelp32Snapshot(flags uint32, processId uint32) (handle Handle, err error) [failretval==InvalidHandle] = kernel32.CreateToolhelp32Snapshot
 //sys	Module32First(snapshot Handle, moduleEntry *ModuleEntry32) (err error) = kernel32.Module32FirstW
 //sys	Module32Next(snapshot Handle, moduleEntry *ModuleEntry32) (err error) = kernel32.Module32NextW
@@ -1667,12 +1668,8 @@ func NewNTUnicodeString(s string) (*NTUnicodeString, error) {
 
 // Slice returns a uint16 slice that aliases the data in the NTUnicodeString.
 func (s *NTUnicodeString) Slice() []uint16 {
-	var slice []uint16
-	hdr := (*unsafeheader.Slice)(unsafe.Pointer(&slice))
-	hdr.Data = unsafe.Pointer(s.Buffer)
-	hdr.Len = int(s.Length)
-	hdr.Cap = int(s.MaximumLength)
-	return slice
+	slice := unsafe.Slice(s.Buffer, s.MaximumLength)
+	return slice[:s.Length]
 }
 
 func (s *NTUnicodeString) String() string {
@@ -1695,12 +1692,8 @@ func NewNTString(s string) (*NTString, error) {
 
 // Slice returns a byte slice that aliases the data in the NTString.
 func (s *NTString) Slice() []byte {
-	var slice []byte
-	hdr := (*unsafeheader.Slice)(unsafe.Pointer(&slice))
-	hdr.Data = unsafe.Pointer(s.Buffer)
-	hdr.Len = int(s.Length)
-	hdr.Cap = int(s.MaximumLength)
-	return slice
+	slice := unsafe.Slice(s.Buffer, s.MaximumLength)
+	return slice[:s.Length]
 }
 
 func (s *NTString) String() string {
@@ -1752,10 +1745,7 @@ func LoadResourceData(module, resInfo Handle) (data []byte, err error) {
 	if err != nil {
 		return
 	}
-	h := (*unsafeheader.Slice)(unsafe.Pointer(&data))
-	h.Data = unsafe.Pointer(ptr)
-	h.Len = int(size)
-	h.Cap = int(size)
+	data = unsafe.Slice((*byte)(unsafe.Pointer(ptr)), size)
 	return
 }
 
@@ -1826,3 +1816,17 @@ type PSAPI_WORKING_SET_EX_INFORMATION struct {
 	// A PSAPI_WORKING_SET_EX_BLOCK union that indicates the attributes of the page at VirtualAddress.
 	VirtualAttributes PSAPI_WORKING_SET_EX_BLOCK
 }
+
+// CreatePseudoConsole creates a windows pseudo console.
+func CreatePseudoConsole(size Coord, in Handle, out Handle, flags uint32, pconsole *Handle) error {
+	// We need this wrapper to manually cast Coord to uint32. The autogenerated wrappers only
+	// accept arguments that can be casted to uintptr, and Coord can't.
+	return createPseudoConsole(*((*uint32)(unsafe.Pointer(&size))), in, out, flags, pconsole)
+}
+
+// ResizePseudoConsole resizes the internal buffers of the pseudo console to the width and height specified in `size`.
+func ResizePseudoConsole(pconsole Handle, size Coord) error {
+	// We need this wrapper to manually cast Coord to uint32. The autogenerated wrappers only
+	// accept arguments that can be casted to uintptr, and Coord can't.
+	return resizePseudoConsole(pconsole, *((*uint32)(unsafe.Pointer(&size))))
+}
diff --git a/vendor/golang.org/x/sys/windows/types_windows.go b/vendor/golang.org/x/sys/windows/types_windows.go
index 88e62a638..b88dc7c85 100644
--- a/vendor/golang.org/x/sys/windows/types_windows.go
+++ b/vendor/golang.org/x/sys/windows/types_windows.go
@@ -247,6 +247,7 @@ const (
 	PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY = 0x00020007
 	PROC_THREAD_ATTRIBUTE_UMS_THREAD        = 0x00030006
 	PROC_THREAD_ATTRIBUTE_PROTECTION_LEVEL  = 0x0002000b
+	PROC_THREAD_ATTRIBUTE_PSEUDOCONSOLE     = 0x00020016
 )
 
 const (
@@ -2139,6 +2140,12 @@ const (
 	ENABLE_LVB_GRID_WORLDWIDE          = 0x10
 )
 
+// Pseudo console related constants used for the flags parameter to
+// CreatePseudoConsole. See: https://learn.microsoft.com/en-us/windows/console/createpseudoconsole
+const (
+	PSEUDOCONSOLE_INHERIT_CURSOR = 0x1
+)
+
 type Coord struct {
 	X int16
 	Y int16
diff --git a/vendor/golang.org/x/sys/windows/zsyscall_windows.go b/vendor/golang.org/x/sys/windows/zsyscall_windows.go
index 5c385580f..8b1688de4 100644
--- a/vendor/golang.org/x/sys/windows/zsyscall_windows.go
+++ b/vendor/golang.org/x/sys/windows/zsyscall_windows.go
@@ -188,6 +188,7 @@ var (
 	procCancelIo                                             = modkernel32.NewProc("CancelIo")
 	procCancelIoEx                                           = modkernel32.NewProc("CancelIoEx")
 	procCloseHandle                                          = modkernel32.NewProc("CloseHandle")
+	procClosePseudoConsole                                   = modkernel32.NewProc("ClosePseudoConsole")
 	procConnectNamedPipe                                     = modkernel32.NewProc("ConnectNamedPipe")
 	procCreateDirectoryW                                     = modkernel32.NewProc("CreateDirectoryW")
 	procCreateEventExW                                       = modkernel32.NewProc("CreateEventExW")
@@ -202,6 +203,7 @@ var (
 	procCreateNamedPipeW                                     = modkernel32.NewProc("CreateNamedPipeW")
 	procCreatePipe                                           = modkernel32.NewProc("CreatePipe")
 	procCreateProcessW                                       = modkernel32.NewProc("CreateProcessW")
+	procCreatePseudoConsole                                  = modkernel32.NewProc("CreatePseudoConsole")
 	procCreateSymbolicLinkW                                  = modkernel32.NewProc("CreateSymbolicLinkW")
 	procCreateToolhelp32Snapshot                             = modkernel32.NewProc("CreateToolhelp32Snapshot")
 	procDefineDosDeviceW                                     = modkernel32.NewProc("DefineDosDeviceW")
@@ -328,6 +330,7 @@ var (
 	procReleaseMutex                                         = modkernel32.NewProc("ReleaseMutex")
 	procRemoveDirectoryW                                     = modkernel32.NewProc("RemoveDirectoryW")
 	procResetEvent                                           = modkernel32.NewProc("ResetEvent")
+	procResizePseudoConsole                                  = modkernel32.NewProc("ResizePseudoConsole")
 	procResumeThread                                         = modkernel32.NewProc("ResumeThread")
 	procSetCommTimeouts                                      = modkernel32.NewProc("SetCommTimeouts")
 	procSetConsoleCursorPosition                             = modkernel32.NewProc("SetConsoleCursorPosition")
@@ -1633,6 +1636,11 @@ func CloseHandle(handle Handle) (err error) {
 	return
 }
 
+func ClosePseudoConsole(console Handle) {
+	syscall.Syscall(procClosePseudoConsole.Addr(), 1, uintptr(console), 0, 0)
+	return
+}
+
 func ConnectNamedPipe(pipe Handle, overlapped *Overlapped) (err error) {
 	r1, _, e1 := syscall.Syscall(procConnectNamedPipe.Addr(), 2, uintptr(pipe), uintptr(unsafe.Pointer(overlapped)), 0)
 	if r1 == 0 {
@@ -1762,6 +1770,14 @@ func CreateProcess(appName *uint16, commandLine *uint16, procSecurity *SecurityA
 	return
 }
 
+func createPseudoConsole(size uint32, in Handle, out Handle, flags uint32, pconsole *Handle) (hr error) {
+	r0, _, _ := syscall.Syscall6(procCreatePseudoConsole.Addr(), 5, uintptr(size), uintptr(in), uintptr(out), uintptr(flags), uintptr(unsafe.Pointer(pconsole)), 0)
+	if r0 != 0 {
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
 func CreateSymbolicLink(symlinkfilename *uint16, targetfilename *uint16, flags uint32) (err error) {
 	r1, _, e1 := syscall.Syscall(procCreateSymbolicLinkW.Addr(), 3, uintptr(unsafe.Pointer(symlinkfilename)), uintptr(unsafe.Pointer(targetfilename)), uintptr(flags))
 	if r1&0xff == 0 {
@@ -2862,6 +2878,14 @@ func ResetEvent(event Handle) (err error) {
 	return
 }
 
+func resizePseudoConsole(pconsole Handle, size uint32) (hr error) {
+	r0, _, _ := syscall.Syscall(procResizePseudoConsole.Addr(), 2, uintptr(pconsole), uintptr(size), 0)
+	if r0 != 0 {
+		hr = syscall.Errno(r0)
+	}
+	return
+}
+
 func ResumeThread(thread Handle) (ret uint32, err error) {
 	r0, _, e1 := syscall.Syscall(procResumeThread.Addr(), 1, uintptr(thread), 0, 0)
 	ret = uint32(r0)
@@ -3820,9 +3844,9 @@ func setupUninstallOEMInf(infFileName *uint16, flags SUOI, reserved uintptr) (er
 	return
 }
 
-func CommandLineToArgv(cmd *uint16, argc *int32) (argv *[8192]*[8192]uint16, err error) {
+func commandLineToArgv(cmd *uint16, argc *int32) (argv **uint16, err error) {
 	r0, _, e1 := syscall.Syscall(procCommandLineToArgvW.Addr(), 2, uintptr(unsafe.Pointer(cmd)), uintptr(unsafe.Pointer(argc)), 0)
-	argv = (*[8192]*[8192]uint16)(unsafe.Pointer(r0))
+	argv = (**uint16)(unsafe.Pointer(r0))
 	if argv == nil {
 		err = errnoErr(e1)
 	}
diff --git a/vendor/golang.org/x/tools/cmd/stringer/stringer.go b/vendor/golang.org/x/tools/cmd/stringer/stringer.go
index 998d1a51b..2b19c93e8 100644
--- a/vendor/golang.org/x/tools/cmd/stringer/stringer.go
+++ b/vendor/golang.org/x/tools/cmd/stringer/stringer.go
@@ -188,6 +188,8 @@ type Generator struct {
 
 	trimPrefix  string
 	lineComment bool
+
+	logf func(format string, args ...interface{}) // test logging hook; nil when not testing
 }
 
 func (g *Generator) Printf(format string, args ...interface{}) {
@@ -221,13 +223,14 @@ func (g *Generator) parsePackage(patterns []string, tags []string) {
 		// in a separate pass? For later.
 		Tests:      false,
 		BuildFlags: []string{fmt.Sprintf("-tags=%s", strings.Join(tags, " "))},
+		Logf:       g.logf,
 	}
 	pkgs, err := packages.Load(cfg, patterns...)
 	if err != nil {
 		log.Fatal(err)
 	}
 	if len(pkgs) != 1 {
-		log.Fatalf("error: %d packages found", len(pkgs))
+		log.Fatalf("error: %d packages matching %v", len(pkgs), strings.Join(patterns, " "))
 	}
 	g.addPackage(pkgs[0])
 }
diff --git a/vendor/golang.org/x/tools/go/packages/doc.go b/vendor/golang.org/x/tools/go/packages/doc.go
index da4ab89fe..a7a8f73e3 100644
--- a/vendor/golang.org/x/tools/go/packages/doc.go
+++ b/vendor/golang.org/x/tools/go/packages/doc.go
@@ -35,7 +35,7 @@ The Package struct provides basic information about the package, including
   - Imports, a map from source import strings to the Packages they name;
   - Types, the type information for the package's exported symbols;
   - Syntax, the parsed syntax trees for the package's source code; and
-  - TypeInfo, the result of a complete type-check of the package syntax trees.
+  - TypesInfo, the result of a complete type-check of the package syntax trees.
 
 (See the documentation for type Package for the complete list of fields
 and more detailed descriptions.)
diff --git a/vendor/golang.org/x/tools/go/packages/golist.go b/vendor/golang.org/x/tools/go/packages/golist.go
index b5de9cf9f..1f1eade0a 100644
--- a/vendor/golang.org/x/tools/go/packages/golist.go
+++ b/vendor/golang.org/x/tools/go/packages/golist.go
@@ -9,7 +9,6 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
 	"log"
 	"os"
 	"path"
@@ -1109,7 +1108,7 @@ func (state *golistState) writeOverlays() (filename string, cleanup func(), err
 	if len(state.cfg.Overlay) == 0 {
 		return "", func() {}, nil
 	}
-	dir, err := ioutil.TempDir("", "gopackages-*")
+	dir, err := os.MkdirTemp("", "gopackages-*")
 	if err != nil {
 		return "", nil, err
 	}
@@ -1128,7 +1127,7 @@ func (state *golistState) writeOverlays() (filename string, cleanup func(), err
 		// Create a unique filename for the overlaid files, to avoid
 		// creating nested directories.
 		noSeparator := strings.Join(strings.Split(filepath.ToSlash(k), "/"), "")
-		f, err := ioutil.TempFile(dir, fmt.Sprintf("*-%s", noSeparator))
+		f, err := os.CreateTemp(dir, fmt.Sprintf("*-%s", noSeparator))
 		if err != nil {
 			return "", func() {}, err
 		}
@@ -1146,7 +1145,7 @@ func (state *golistState) writeOverlays() (filename string, cleanup func(), err
 	}
 	// Write out the overlay file that contains the filepath mappings.
 	filename = filepath.Join(dir, "overlay.json")
-	if err := ioutil.WriteFile(filename, b, 0665); err != nil {
+	if err := os.WriteFile(filename, b, 0665); err != nil {
 		return "", func() {}, err
 	}
 	return filename, cleanup, nil
diff --git a/vendor/golang.org/x/tools/go/packages/packages.go b/vendor/golang.org/x/tools/go/packages/packages.go
index 124a6fe14..ece0e7c60 100644
--- a/vendor/golang.org/x/tools/go/packages/packages.go
+++ b/vendor/golang.org/x/tools/go/packages/packages.go
@@ -16,7 +16,6 @@ import (
 	"go/token"
 	"go/types"
 	"io"
-	"io/ioutil"
 	"log"
 	"os"
 	"path/filepath"
@@ -1127,7 +1126,7 @@ func (ld *loader) parseFile(filename string) (*ast.File, error) {
 		var err error
 		if src == nil {
 			ioLimit <- true // wait
-			src, err = ioutil.ReadFile(filename)
+			src, err = os.ReadFile(filename)
 			<-ioLimit // signal
 		}
 		if err != nil {
diff --git a/vendor/golang.org/x/tools/internal/gcimporter/gcimporter.go b/vendor/golang.org/x/tools/internal/gcimporter/gcimporter.go
index b1223713b..2d078ccb1 100644
--- a/vendor/golang.org/x/tools/internal/gcimporter/gcimporter.go
+++ b/vendor/golang.org/x/tools/internal/gcimporter/gcimporter.go
@@ -29,7 +29,6 @@ import (
 	"go/token"
 	"go/types"
 	"io"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -221,7 +220,7 @@ func Import(packages map[string]*types.Package, path, srcDir string, lookup func
 	switch hdr {
 	case "$$B\n":
 		var data []byte
-		data, err = ioutil.ReadAll(buf)
+		data, err = io.ReadAll(buf)
 		if err != nil {
 			break
 		}
diff --git a/vendor/google.golang.org/api/internal/version.go b/vendor/google.golang.org/api/internal/version.go
index 52a7e7356..b0a50e841 100644
--- a/vendor/google.golang.org/api/internal/version.go
+++ b/vendor/google.golang.org/api/internal/version.go
@@ -5,4 +5,4 @@
 package internal
 
 // Version is the current tagged release of the library.
-const Version = "0.143.0"
+const Version = "0.147.0"
diff --git a/vendor/google.golang.org/api/storage/v1/storage-api.json b/vendor/google.golang.org/api/storage/v1/storage-api.json
index 64831d2df..adc2dc58b 100644
--- a/vendor/google.golang.org/api/storage/v1/storage-api.json
+++ b/vendor/google.golang.org/api/storage/v1/storage-api.json
@@ -26,7 +26,7 @@
   "description": "Stores and retrieves potentially large, immutable data objects.",
   "discoveryVersion": "v1",
   "documentationLink": "https://developers.google.com/storage/docs/json_api/",
-  "etag": "\"3132363038323634353839373135393539313634\"",
+  "etag": "\"32313532343139313031303538363232393732\"",
   "icons": {
     "x16": "https://www.google.com/images/icons/product/cloud_storage-16.png",
     "x32": "https://www.google.com/images/icons/product/cloud_storage-32.png"
@@ -2373,6 +2373,11 @@
               "required": true,
               "type": "string"
             },
+            "copySourceAcl": {
+              "description": "If true, copies the source object's ACL; otherwise, uses the bucket's default object ACL. The default is false.",
+              "location": "query",
+              "type": "boolean"
+            },
             "generation": {
               "description": "Selects a specific revision of this object.",
               "format": "int64",
@@ -3258,7 +3263,7 @@
       }
     }
   },
-  "revision": "20230914",
+  "revision": "20230926",
   "rootUrl": "https://storage.googleapis.com/",
   "schemas": {
     "Bucket": {
@@ -4305,6 +4310,11 @@
           "format": "int64",
           "type": "string"
         },
+        "hardDeleteTime": {
+          "description": "This is the time (in the future) when the soft-deleted object will no longer be restorable. It is equal to the soft delete time plus the current soft delete retention duration of the bucket.",
+          "format": "date-time",
+          "type": "string"
+        },
         "id": {
           "description": "The ID of the object, including the bucket name, object name, and generation number.",
           "type": "string"
@@ -4386,6 +4396,11 @@
           "format": "uint64",
           "type": "string"
         },
+        "softDeleteTime": {
+          "description": "The time at which the object became soft-deleted in RFC 3339 format.",
+          "format": "date-time",
+          "type": "string"
+        },
         "storageClass": {
           "description": "Storage class of the object.",
           "type": "string"
@@ -4400,7 +4415,7 @@
           "type": "string"
         },
         "timeDeleted": {
-          "description": "The deletion time of the object in RFC 3339 format. Will be returned if and only if this version of the object has been deleted.",
+          "description": "The time at which the object became noncurrent in RFC 3339 format. Will be returned if and only if this version of the object has been deleted.",
           "format": "date-time",
           "type": "string"
         },
diff --git a/vendor/google.golang.org/api/storage/v1/storage-gen.go b/vendor/google.golang.org/api/storage/v1/storage-gen.go
index 952d1b3e0..e35440cc3 100644
--- a/vendor/google.golang.org/api/storage/v1/storage-gen.go
+++ b/vendor/google.golang.org/api/storage/v1/storage-gen.go
@@ -2118,6 +2118,12 @@ type Object struct {
 	// versioning.
 	Generation int64 `json:"generation,omitempty,string"`
 
+	// HardDeleteTime: This is the time (in the future) when the
+	// soft-deleted object will no longer be restorable. It is equal to the
+	// soft delete time plus the current soft delete retention duration of
+	// the bucket.
+	HardDeleteTime string `json:"hardDeleteTime,omitempty"`
+
 	// Id: The ID of the object, including the bucket name, object name, and
 	// generation number.
 	Id string `json:"id,omitempty"`
@@ -2173,6 +2179,10 @@ type Object struct {
 	// Size: Content-Length of the data in bytes.
 	Size uint64 `json:"size,omitempty,string"`
 
+	// SoftDeleteTime: The time at which the object became soft-deleted in
+	// RFC 3339 format.
+	SoftDeleteTime string `json:"softDeleteTime,omitempty"`
+
 	// StorageClass: Storage class of the object.
 	StorageClass string `json:"storageClass,omitempty"`
 
@@ -2188,9 +2198,9 @@ type Object struct {
 	// TimeCreated: The creation time of the object in RFC 3339 format.
 	TimeCreated string `json:"timeCreated,omitempty"`
 
-	// TimeDeleted: The deletion time of the object in RFC 3339 format. Will
-	// be returned if and only if this version of the object has been
-	// deleted.
+	// TimeDeleted: The time at which the object became noncurrent in RFC
+	// 3339 format. Will be returned if and only if this version of the
+	// object has been deleted.
 	TimeDeleted string `json:"timeDeleted,omitempty"`
 
 	// TimeStorageClassUpdated: The time at which the object's storage class
@@ -11395,6 +11405,14 @@ func (r *ObjectsService) Restore(bucket string, object string, object2 *Object)
 	return c
 }
 
+// CopySourceAcl sets the optional parameter "copySourceAcl": If true,
+// copies the source object's ACL; otherwise, uses the bucket's default
+// object ACL. The default is false.
+func (c *ObjectsRestoreCall) CopySourceAcl(copySourceAcl bool) *ObjectsRestoreCall {
+	c.urlParams_.Set("copySourceAcl", fmt.Sprint(copySourceAcl))
+	return c
+}
+
 // IfGenerationMatch sets the optional parameter "ifGenerationMatch":
 // Makes the operation conditional on whether the object's one live
 // generation matches the given value. Setting to 0 makes the operation
@@ -11556,6 +11574,11 @@ func (c *ObjectsRestoreCall) Do(opts ...googleapi.CallOption) (*Object, error) {
 	//       "required": true,
 	//       "type": "string"
 	//     },
+	//     "copySourceAcl": {
+	//       "description": "If true, copies the source object's ACL; otherwise, uses the bucket's default object ACL. The default is false.",
+	//       "location": "query",
+	//       "type": "boolean"
+	//     },
 	//     "generation": {
 	//       "description": "Selects a specific revision of this object.",
 	//       "format": "int64",
diff --git a/vendor/google.golang.org/genproto/googleapis/api/annotations/field_info.pb.go b/vendor/google.golang.org/genproto/googleapis/api/annotations/field_info.pb.go
new file mode 100644
index 000000000..d02e6bbc8
--- /dev/null
+++ b/vendor/google.golang.org/genproto/googleapis/api/annotations/field_info.pb.go
@@ -0,0 +1,295 @@
+// Copyright 2023 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.26.0
+// 	protoc        v3.21.12
+// source: google/api/field_info.proto
+
+package annotations
+
+import (
+	reflect "reflect"
+	sync "sync"
+
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	descriptorpb "google.golang.org/protobuf/types/descriptorpb"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// The standard format of a field value. The supported formats are all backed
+// by either an RFC defined by the IETF or a Google-defined AIP.
+type FieldInfo_Format int32
+
+const (
+	// Default, unspecified value.
+	FieldInfo_FORMAT_UNSPECIFIED FieldInfo_Format = 0
+	// Universally Unique Identifier, version 4, value as defined by
+	// https://datatracker.ietf.org/doc/html/rfc4122. The value may be
+	// normalized to entirely lowercase letters. For example, the value
+	// `F47AC10B-58CC-0372-8567-0E02B2C3D479` would be normalized to
+	// `f47ac10b-58cc-0372-8567-0e02b2c3d479`.
+	FieldInfo_UUID4 FieldInfo_Format = 1
+	// Internet Protocol v4 value as defined by [RFC
+	// 791](https://datatracker.ietf.org/doc/html/rfc791). The value may be
+	// condensed, with leading zeros in each octet stripped. For example,
+	// `001.022.233.040` would be condensed to `1.22.233.40`.
+	FieldInfo_IPV4 FieldInfo_Format = 2
+	// Internet Protocol v6 value as defined by [RFC
+	// 2460](https://datatracker.ietf.org/doc/html/rfc2460). The value may be
+	// normalized to entirely lowercase letters, and zero-padded partial and
+	// empty octets. For example, the value `2001:DB8::` would be normalized to
+	// `2001:0db8:0:0`.
+	FieldInfo_IPV6 FieldInfo_Format = 3
+	// An IP address in either v4 or v6 format as described by the individual
+	// values defined herein. See the comments on the IPV4 and IPV6 types for
+	// allowed normalizations of each.
+	FieldInfo_IPV4_OR_IPV6 FieldInfo_Format = 4
+)
+
+// Enum value maps for FieldInfo_Format.
+var (
+	FieldInfo_Format_name = map[int32]string{
+		0: "FORMAT_UNSPECIFIED",
+		1: "UUID4",
+		2: "IPV4",
+		3: "IPV6",
+		4: "IPV4_OR_IPV6",
+	}
+	FieldInfo_Format_value = map[string]int32{
+		"FORMAT_UNSPECIFIED": 0,
+		"UUID4":              1,
+		"IPV4":               2,
+		"IPV6":               3,
+		"IPV4_OR_IPV6":       4,
+	}
+)
+
+func (x FieldInfo_Format) Enum() *FieldInfo_Format {
+	p := new(FieldInfo_Format)
+	*p = x
+	return p
+}
+
+func (x FieldInfo_Format) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (FieldInfo_Format) Descriptor() protoreflect.EnumDescriptor {
+	return file_google_api_field_info_proto_enumTypes[0].Descriptor()
+}
+
+func (FieldInfo_Format) Type() protoreflect.EnumType {
+	return &file_google_api_field_info_proto_enumTypes[0]
+}
+
+func (x FieldInfo_Format) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use FieldInfo_Format.Descriptor instead.
+func (FieldInfo_Format) EnumDescriptor() ([]byte, []int) {
+	return file_google_api_field_info_proto_rawDescGZIP(), []int{0, 0}
+}
+
+// Rich semantic information of an API field beyond basic typing.
+type FieldInfo struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The standard format of a field value. This does not explicitly configure
+	// any API consumer, just documents the API's format for the field it is
+	// applied to.
+	Format FieldInfo_Format `protobuf:"varint,1,opt,name=format,proto3,enum=google.api.FieldInfo_Format" json:"format,omitempty"`
+}
+
+func (x *FieldInfo) Reset() {
+	*x = FieldInfo{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_google_api_field_info_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *FieldInfo) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*FieldInfo) ProtoMessage() {}
+
+func (x *FieldInfo) ProtoReflect() protoreflect.Message {
+	mi := &file_google_api_field_info_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use FieldInfo.ProtoReflect.Descriptor instead.
+func (*FieldInfo) Descriptor() ([]byte, []int) {
+	return file_google_api_field_info_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *FieldInfo) GetFormat() FieldInfo_Format {
+	if x != nil {
+		return x.Format
+	}
+	return FieldInfo_FORMAT_UNSPECIFIED
+}
+
+var file_google_api_field_info_proto_extTypes = []protoimpl.ExtensionInfo{
+	{
+		ExtendedType:  (*descriptorpb.FieldOptions)(nil),
+		ExtensionType: (*FieldInfo)(nil),
+		Field:         291403980,
+		Name:          "google.api.field_info",
+		Tag:           "bytes,291403980,opt,name=field_info",
+		Filename:      "google/api/field_info.proto",
+	},
+}
+
+// Extension fields to descriptorpb.FieldOptions.
+var (
+	// Rich semantic descriptor of an API field beyond the basic typing.
+	//
+	// Examples:
+	//
+	//	string request_id = 1 [(google.api.field_info).format = UUID4];
+	//	string old_ip_address = 2 [(google.api.field_info).format = IPV4];
+	//	string new_ip_address = 3 [(google.api.field_info).format = IPV6];
+	//	string actual_ip_address = 4 [
+	//	  (google.api.field_info).format = IPV4_OR_IPV6
+	//	];
+	//
+	// optional google.api.FieldInfo field_info = 291403980;
+	E_FieldInfo = &file_google_api_field_info_proto_extTypes[0]
+)
+
+var File_google_api_field_info_proto protoreflect.FileDescriptor
+
+var file_google_api_field_info_proto_rawDesc = []byte{
+	0x0a, 0x1b, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x66, 0x69, 0x65,
+	0x6c, 0x64, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0a, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x1a, 0x20, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x64, 0x65, 0x73, 0x63, 0x72,
+	0x69, 0x70, 0x74, 0x6f, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x94, 0x01, 0x0a, 0x09,
+	0x46, 0x69, 0x65, 0x6c, 0x64, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x34, 0x0a, 0x06, 0x66, 0x6f, 0x72,
+	0x6d, 0x61, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x49, 0x6e, 0x66, 0x6f,
+	0x2e, 0x46, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x52, 0x06, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x22,
+	0x51, 0x0a, 0x06, 0x46, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0x16, 0x0a, 0x12, 0x46, 0x4f, 0x52,
+	0x4d, 0x41, 0x54, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10,
+	0x00, 0x12, 0x09, 0x0a, 0x05, 0x55, 0x55, 0x49, 0x44, 0x34, 0x10, 0x01, 0x12, 0x08, 0x0a, 0x04,
+	0x49, 0x50, 0x56, 0x34, 0x10, 0x02, 0x12, 0x08, 0x0a, 0x04, 0x49, 0x50, 0x56, 0x36, 0x10, 0x03,
+	0x12, 0x10, 0x0a, 0x0c, 0x49, 0x50, 0x56, 0x34, 0x5f, 0x4f, 0x52, 0x5f, 0x49, 0x50, 0x56, 0x36,
+	0x10, 0x04, 0x3a, 0x57, 0x0a, 0x0a, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x5f, 0x69, 0x6e, 0x66, 0x6f,
+	0x12, 0x1d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
+	0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18,
+	0xcc, 0xf1, 0xf9, 0x8a, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x49, 0x6e, 0x66, 0x6f,
+	0x52, 0x09, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x49, 0x6e, 0x66, 0x6f, 0x42, 0x6c, 0x0a, 0x0e, 0x63,
+	0x6f, 0x6d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x61, 0x70, 0x69, 0x42, 0x0e, 0x46,
+	0x69, 0x65, 0x6c, 0x64, 0x49, 0x6e, 0x66, 0x6f, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a,
+	0x41, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x67, 0x6f, 0x6c, 0x61, 0x6e, 0x67, 0x2e, 0x6f,
+	0x72, 0x67, 0x2f, 0x67, 0x65, 0x6e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x61, 0x70, 0x69, 0x73, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x61, 0x6e, 0x6e, 0x6f, 0x74,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x3b, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0xa2, 0x02, 0x04, 0x47, 0x41, 0x50, 0x49, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x33,
+}
+
+var (
+	file_google_api_field_info_proto_rawDescOnce sync.Once
+	file_google_api_field_info_proto_rawDescData = file_google_api_field_info_proto_rawDesc
+)
+
+func file_google_api_field_info_proto_rawDescGZIP() []byte {
+	file_google_api_field_info_proto_rawDescOnce.Do(func() {
+		file_google_api_field_info_proto_rawDescData = protoimpl.X.CompressGZIP(file_google_api_field_info_proto_rawDescData)
+	})
+	return file_google_api_field_info_proto_rawDescData
+}
+
+var file_google_api_field_info_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_google_api_field_info_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_google_api_field_info_proto_goTypes = []interface{}{
+	(FieldInfo_Format)(0),             // 0: google.api.FieldInfo.Format
+	(*FieldInfo)(nil),                 // 1: google.api.FieldInfo
+	(*descriptorpb.FieldOptions)(nil), // 2: google.protobuf.FieldOptions
+}
+var file_google_api_field_info_proto_depIdxs = []int32{
+	0, // 0: google.api.FieldInfo.format:type_name -> google.api.FieldInfo.Format
+	2, // 1: google.api.field_info:extendee -> google.protobuf.FieldOptions
+	1, // 2: google.api.field_info:type_name -> google.api.FieldInfo
+	3, // [3:3] is the sub-list for method output_type
+	3, // [3:3] is the sub-list for method input_type
+	2, // [2:3] is the sub-list for extension type_name
+	1, // [1:2] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_google_api_field_info_proto_init() }
+func file_google_api_field_info_proto_init() {
+	if File_google_api_field_info_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_google_api_field_info_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*FieldInfo); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_google_api_field_info_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   1,
+			NumExtensions: 1,
+			NumServices:   0,
+		},
+		GoTypes:           file_google_api_field_info_proto_goTypes,
+		DependencyIndexes: file_google_api_field_info_proto_depIdxs,
+		EnumInfos:         file_google_api_field_info_proto_enumTypes,
+		MessageInfos:      file_google_api_field_info_proto_msgTypes,
+		ExtensionInfos:    file_google_api_field_info_proto_extTypes,
+	}.Build()
+	File_google_api_field_info_proto = out.File
+	file_google_api_field_info_proto_rawDesc = nil
+	file_google_api_field_info_proto_goTypes = nil
+	file_google_api_field_info_proto_depIdxs = nil
+}
diff --git a/vendor/google.golang.org/grpc/internal/transport/http2_server.go b/vendor/google.golang.org/grpc/internal/transport/http2_server.go
index 8d3a353c1..c06db679d 100644
--- a/vendor/google.golang.org/grpc/internal/transport/http2_server.go
+++ b/vendor/google.golang.org/grpc/internal/transport/http2_server.go
@@ -171,15 +171,10 @@ func NewServerTransport(conn net.Conn, config *ServerConfig) (_ ServerTransport,
 		ID:  http2.SettingMaxFrameSize,
 		Val: http2MaxFrameLen,
 	}}
-	// TODO(zhaoq): Have a better way to signal "no limit" because 0 is
-	// permitted in the HTTP2 spec.
-	maxStreams := config.MaxStreams
-	if maxStreams == 0 {
-		maxStreams = math.MaxUint32
-	} else {
+	if config.MaxStreams != math.MaxUint32 {
 		isettings = append(isettings, http2.Setting{
 			ID:  http2.SettingMaxConcurrentStreams,
-			Val: maxStreams,
+			Val: config.MaxStreams,
 		})
 	}
 	dynamicWindow := true
@@ -258,7 +253,7 @@ func NewServerTransport(conn net.Conn, config *ServerConfig) (_ ServerTransport,
 		framer:            framer,
 		readerDone:        make(chan struct{}),
 		writerDone:        make(chan struct{}),
-		maxStreams:        maxStreams,
+		maxStreams:        config.MaxStreams,
 		inTapHandle:       config.InTapHandle,
 		fc:                &trInFlow{limit: uint32(icwz)},
 		state:             reachable,
diff --git a/vendor/google.golang.org/grpc/server.go b/vendor/google.golang.org/grpc/server.go
index 244123c6c..eeae92fbe 100644
--- a/vendor/google.golang.org/grpc/server.go
+++ b/vendor/google.golang.org/grpc/server.go
@@ -115,12 +115,6 @@ type serviceInfo struct {
 	mdata       any
 }
 
-type serverWorkerData struct {
-	st     transport.ServerTransport
-	wg     *sync.WaitGroup
-	stream *transport.Stream
-}
-
 // Server is a gRPC server to serve RPC requests.
 type Server struct {
 	opts serverOptions
@@ -145,7 +139,7 @@ type Server struct {
 	channelzID *channelz.Identifier
 	czData     *channelzData
 
-	serverWorkerChannel chan *serverWorkerData
+	serverWorkerChannel chan func()
 }
 
 type serverOptions struct {
@@ -179,6 +173,7 @@ type serverOptions struct {
 }
 
 var defaultServerOptions = serverOptions{
+	maxConcurrentStreams:  math.MaxUint32,
 	maxReceiveMessageSize: defaultServerMaxReceiveMessageSize,
 	maxSendMessageSize:    defaultServerMaxSendMessageSize,
 	connectionTimeout:     120 * time.Second,
@@ -404,6 +399,9 @@ func MaxSendMsgSize(m int) ServerOption {
 // MaxConcurrentStreams returns a ServerOption that will apply a limit on the number
 // of concurrent streams to each ServerTransport.
 func MaxConcurrentStreams(n uint32) ServerOption {
+	if n == 0 {
+		n = math.MaxUint32
+	}
 	return newFuncServerOption(func(o *serverOptions) {
 		o.maxConcurrentStreams = n
 	})
@@ -605,24 +603,19 @@ const serverWorkerResetThreshold = 1 << 16
 // [1] https://github.com/golang/go/issues/18138
 func (s *Server) serverWorker() {
 	for completed := 0; completed < serverWorkerResetThreshold; completed++ {
-		data, ok := <-s.serverWorkerChannel
+		f, ok := <-s.serverWorkerChannel
 		if !ok {
 			return
 		}
-		s.handleSingleStream(data)
+		f()
 	}
 	go s.serverWorker()
 }
 
-func (s *Server) handleSingleStream(data *serverWorkerData) {
-	defer data.wg.Done()
-	s.handleStream(data.st, data.stream, s.traceInfo(data.st, data.stream))
-}
-
 // initServerWorkers creates worker goroutines and a channel to process incoming
 // connections to reduce the time spent overall on runtime.morestack.
 func (s *Server) initServerWorkers() {
-	s.serverWorkerChannel = make(chan *serverWorkerData)
+	s.serverWorkerChannel = make(chan func())
 	for i := uint32(0); i < s.opts.numServerWorkers; i++ {
 		go s.serverWorker()
 	}
@@ -982,21 +975,26 @@ func (s *Server) serveStreams(st transport.ServerTransport) {
 	defer st.Close(errors.New("finished serving streams for the server transport"))
 	var wg sync.WaitGroup
 
+	streamQuota := newHandlerQuota(s.opts.maxConcurrentStreams)
 	st.HandleStreams(func(stream *transport.Stream) {
 		wg.Add(1)
+
+		streamQuota.acquire()
+		f := func() {
+			defer streamQuota.release()
+			defer wg.Done()
+			s.handleStream(st, stream, s.traceInfo(st, stream))
+		}
+
 		if s.opts.numServerWorkers > 0 {
-			data := &serverWorkerData{st: st, wg: &wg, stream: stream}
 			select {
-			case s.serverWorkerChannel <- data:
+			case s.serverWorkerChannel <- f:
 				return
 			default:
 				// If all stream workers are busy, fallback to the default code path.
 			}
 		}
-		go func() {
-			defer wg.Done()
-			s.handleStream(st, stream, s.traceInfo(st, stream))
-		}()
+		go f()
 	}, func(ctx context.Context, method string) context.Context {
 		if !EnableTracing {
 			return ctx
@@ -2091,3 +2089,34 @@ func validateSendCompressor(name, clientCompressors string) error {
 	}
 	return fmt.Errorf("client does not support compressor %q", name)
 }
+
+// atomicSemaphore implements a blocking, counting semaphore. acquire should be
+// called synchronously; release may be called asynchronously.
+type atomicSemaphore struct {
+	n    atomic.Int64
+	wait chan struct{}
+}
+
+func (q *atomicSemaphore) acquire() {
+	if q.n.Add(-1) < 0 {
+		// We ran out of quota.  Block until a release happens.
+		<-q.wait
+	}
+}
+
+func (q *atomicSemaphore) release() {
+	// N.B. the "<= 0" check below should allow for this to work with multiple
+	// concurrent calls to acquire, but also note that with synchronous calls to
+	// acquire, as our system does, n will never be less than -1.  There are
+	// fairness issues (queuing) to consider if this was to be generalized.
+	if q.n.Add(1) <= 0 {
+		// An acquire was waiting on us.  Unblock it.
+		q.wait <- struct{}{}
+	}
+}
+
+func newHandlerQuota(n uint32) *atomicSemaphore {
+	a := &atomicSemaphore{wait: make(chan struct{}, 1)}
+	a.n.Store(int64(n))
+	return a
+}
diff --git a/vendor/google.golang.org/grpc/version.go b/vendor/google.golang.org/grpc/version.go
index d3f5bcbfc..724ad2102 100644
--- a/vendor/google.golang.org/grpc/version.go
+++ b/vendor/google.golang.org/grpc/version.go
@@ -19,4 +19,4 @@
 package grpc
 
 // Version is the current grpc version.
-const Version = "1.58.2"
+const Version = "1.58.3"
diff --git a/vendor/modules.txt b/vendor/modules.txt
index d7ab56b32..7d8523fb3 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -4,13 +4,13 @@ cloud.google.com/go/internal
 cloud.google.com/go/internal/optional
 cloud.google.com/go/internal/trace
 cloud.google.com/go/internal/version
-# cloud.google.com/go/compute v1.23.0
+# cloud.google.com/go/compute v1.23.1
 ## explicit; go 1.19
 cloud.google.com/go/compute/internal
 # cloud.google.com/go/compute/metadata v0.2.3
 ## explicit; go 1.19
 cloud.google.com/go/compute/metadata
-# cloud.google.com/go/iam v1.1.2
+# cloud.google.com/go/iam v1.1.3
 ## explicit; go 1.19
 cloud.google.com/go/iam
 cloud.google.com/go/iam/apiv1/iampb
@@ -20,8 +20,8 @@ cloud.google.com/go/storage
 cloud.google.com/go/storage/internal
 cloud.google.com/go/storage/internal/apiv2
 cloud.google.com/go/storage/internal/apiv2/storagepb
-# cuelang.org/go v0.5.0
-## explicit; go 1.18
+# cuelang.org/go v0.5.0 => cuelang.org/go v0.4.3
+## explicit; go 1.17
 cuelang.org/go/cue
 cuelang.org/go/cue/ast
 cuelang.org/go/cue/ast/astutil
@@ -32,7 +32,6 @@ cuelang.org/go/cue/format
 cuelang.org/go/cue/literal
 cuelang.org/go/cue/parser
 cuelang.org/go/cue/scanner
-cuelang.org/go/cue/stats
 cuelang.org/go/cue/token
 cuelang.org/go/encoding/json
 cuelang.org/go/internal
@@ -42,7 +41,6 @@ cuelang.org/go/internal/core/adt
 cuelang.org/go/internal/core/compile
 cuelang.org/go/internal/core/convert
 cuelang.org/go/internal/core/debug
-cuelang.org/go/internal/core/dep
 cuelang.org/go/internal/core/eval
 cuelang.org/go/internal/core/export
 cuelang.org/go/internal/core/runtime
@@ -91,7 +89,7 @@ cuelang.org/go/pkg/uuid
 # dario.cat/mergo v1.0.0
 ## explicit; go 1.13
 dario.cat/mergo
-# github.com/99designs/gqlgen v0.17.38
+# github.com/99designs/gqlgen v0.17.39
 ## explicit; go 1.18
 github.com/99designs/gqlgen/graphql
 # github.com/Microsoft/go-winio v0.6.1
@@ -121,14 +119,14 @@ github.com/ProtonMail/go-crypto/openpgp/internal/ecc
 github.com/ProtonMail/go-crypto/openpgp/internal/encoding
 github.com/ProtonMail/go-crypto/openpgp/packet
 github.com/ProtonMail/go-crypto/openpgp/s2k
-# github.com/Yamashou/gqlgenc v0.15.0
+# github.com/Yamashou/gqlgenc v0.15.1
 ## explicit; go 1.19
 github.com/Yamashou/gqlgenc/clientv2
 github.com/Yamashou/gqlgenc/graphqljson
 # github.com/acomagu/bufpipe v1.0.4
 ## explicit; go 1.12
 github.com/acomagu/bufpipe
-# github.com/aws/aws-sdk-go v1.45.16
+# github.com/aws/aws-sdk-go v1.45.25
 ## explicit; go 1.11
 github.com/aws/aws-sdk-go/aws
 github.com/aws/aws-sdk-go/aws/arn
@@ -187,7 +185,7 @@ github.com/aymanbagabas/go-osc52/v2
 # github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d
 ## explicit
 github.com/bgentry/go-netrc/netrc
-# github.com/charmbracelet/lipgloss v0.8.0
+# github.com/charmbracelet/lipgloss v0.9.1
 ## explicit; go 1.17
 github.com/charmbracelet/lipgloss
 # github.com/cloudflare/circl v1.3.3
@@ -207,7 +205,7 @@ github.com/cloudflare/circl/sign/ed448
 # github.com/cockroachdb/apd/v2 v2.0.2
 ## explicit
 github.com/cockroachdb/apd/v2
-# github.com/cpuguy83/go-md2man/v2 v2.0.2
+# github.com/cpuguy83/go-md2man/v2 v2.0.3
 ## explicit; go 1.11
 github.com/cpuguy83/go-md2man/v2/md2man
 # github.com/creack/pty v1.1.18
@@ -296,7 +294,7 @@ github.com/golang/protobuf/ptypes
 github.com/golang/protobuf/ptypes/any
 github.com/golang/protobuf/ptypes/duration
 github.com/golang/protobuf/ptypes/timestamp
-# github.com/google/go-cmp v0.5.9
+# github.com/google/go-cmp v0.6.0
 ## explicit; go 1.13
 github.com/google/go-cmp/cmp
 github.com/google/go-cmp/cmp/cmpopts
@@ -344,7 +342,7 @@ github.com/googleapis/gax-go/v2/internal
 # github.com/hashicorp/go-cleanhttp v0.5.2
 ## explicit; go 1.13
 github.com/hashicorp/go-cleanhttp
-# github.com/hashicorp/go-getter v1.7.2
+# github.com/hashicorp/go-getter v1.7.3
 ## explicit; go 1.13
 github.com/hashicorp/go-getter
 github.com/hashicorp/go-getter/helper/url
@@ -399,12 +397,12 @@ github.com/muesli/reflow/wrap
 # github.com/muesli/termenv v0.15.2
 ## explicit; go 1.17
 github.com/muesli/termenv
-# github.com/nhost/be v0.0.0-20231001065154-f72edc119cf0
+# github.com/nhost/be v0.0.0-20231018093831-a53b01c2d071
 ## explicit; go 1.21
 github.com/nhost/be/services/mimir/model
 github.com/nhost/be/services/mimir/schema
 github.com/nhost/be/services/mimir/schema/appconfig
-# github.com/pelletier/go-toml/v2 v2.0.8 => github.com/dbarrosop/go-toml/v2 v2.0.0-20230603161714-891170c4bf79
+# github.com/pelletier/go-toml/v2 v2.1.0
 ## explicit; go 1.16
 github.com/pelletier/go-toml/v2
 github.com/pelletier/go-toml/v2/internal/characters
@@ -431,6 +429,9 @@ github.com/sergi/go-diff/diffmatchpatch
 # github.com/skeema/knownhosts v1.2.1
 ## explicit; go 1.17
 github.com/skeema/knownhosts
+# github.com/sosodev/duration v1.2.0
+## explicit; go 1.17
+github.com/sosodev/duration
 # github.com/ulikunitz/xz v0.5.11
 ## explicit; go 1.12
 github.com/ulikunitz/xz
@@ -478,7 +479,7 @@ go.opencensus.io/trace
 go.opencensus.io/trace/internal
 go.opencensus.io/trace/propagation
 go.opencensus.io/trace/tracestate
-# golang.org/x/crypto v0.13.0
+# golang.org/x/crypto v0.14.0
 ## explicit; go 1.17
 golang.org/x/crypto/argon2
 golang.org/x/crypto/blake2b
@@ -490,7 +491,6 @@ golang.org/x/crypto/cryptobyte
 golang.org/x/crypto/cryptobyte/asn1
 golang.org/x/crypto/curve25519
 golang.org/x/crypto/curve25519/internal/field
-golang.org/x/crypto/ed25519
 golang.org/x/crypto/hkdf
 golang.org/x/crypto/internal/alias
 golang.org/x/crypto/internal/poly1305
@@ -499,10 +499,10 @@ golang.org/x/crypto/ssh
 golang.org/x/crypto/ssh/agent
 golang.org/x/crypto/ssh/internal/bcrypt_pbkdf
 golang.org/x/crypto/ssh/knownhosts
-# golang.org/x/mod v0.12.0
-## explicit; go 1.17
+# golang.org/x/mod v0.13.0
+## explicit; go 1.18
 golang.org/x/mod/semver
-# golang.org/x/net v0.15.0
+# golang.org/x/net v0.17.0
 ## explicit; go 1.17
 golang.org/x/net/context
 golang.org/x/net/http/httpguts
@@ -513,27 +513,28 @@ golang.org/x/net/internal/socks
 golang.org/x/net/internal/timeseries
 golang.org/x/net/proxy
 golang.org/x/net/trace
-# golang.org/x/oauth2 v0.12.0
+# golang.org/x/oauth2 v0.13.0
 ## explicit; go 1.18
 golang.org/x/oauth2
 golang.org/x/oauth2/authhandler
 golang.org/x/oauth2/google
 golang.org/x/oauth2/google/internal/externalaccount
+golang.org/x/oauth2/google/internal/externalaccountauthorizeduser
+golang.org/x/oauth2/google/internal/stsexchange
 golang.org/x/oauth2/internal
 golang.org/x/oauth2/jws
 golang.org/x/oauth2/jwt
-# golang.org/x/sync v0.3.0
+# golang.org/x/sync v0.4.0
 ## explicit; go 1.17
 golang.org/x/sync/semaphore
-# golang.org/x/sys v0.12.0
+# golang.org/x/sys v0.13.0
 ## explicit; go 1.17
 golang.org/x/sys/cpu
 golang.org/x/sys/execabs
-golang.org/x/sys/internal/unsafeheader
 golang.org/x/sys/plan9
 golang.org/x/sys/unix
 golang.org/x/sys/windows
-# golang.org/x/term v0.12.0
+# golang.org/x/term v0.13.0
 ## explicit; go 1.17
 golang.org/x/term
 # golang.org/x/text v0.13.0
@@ -548,7 +549,7 @@ golang.org/x/text/secure/bidirule
 golang.org/x/text/transform
 golang.org/x/text/unicode/bidi
 golang.org/x/text/unicode/norm
-# golang.org/x/tools v0.13.0
+# golang.org/x/tools v0.14.0
 ## explicit; go 1.18
 golang.org/x/tools/cmd/stringer
 golang.org/x/tools/go/gcexportdata
@@ -567,11 +568,11 @@ golang.org/x/tools/internal/pkgbits
 golang.org/x/tools/internal/tokeninternal
 golang.org/x/tools/internal/typeparams
 golang.org/x/tools/internal/typesinternal
-# golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2
-## explicit; go 1.17
+# golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028
+## explicit; go 1.18
 golang.org/x/xerrors
 golang.org/x/xerrors/internal
-# google.golang.org/api v0.143.0
+# google.golang.org/api v0.147.0
 ## explicit; go 1.19
 google.golang.org/api/googleapi
 google.golang.org/api/googleapi/transport
@@ -601,21 +602,21 @@ google.golang.org/appengine/internal/modules
 google.golang.org/appengine/internal/remote_api
 google.golang.org/appengine/internal/urlfetch
 google.golang.org/appengine/urlfetch
-# google.golang.org/genproto v0.0.0-20230920204549-e6e6cdab5c13
+# google.golang.org/genproto v0.0.0-20231012201019-e917dd12ba7a
 ## explicit; go 1.19
 google.golang.org/genproto/googleapis/type/date
 google.golang.org/genproto/googleapis/type/expr
 google.golang.org/genproto/internal
-# google.golang.org/genproto/googleapis/api v0.0.0-20230920204549-e6e6cdab5c13
+# google.golang.org/genproto/googleapis/api v0.0.0-20231012201019-e917dd12ba7a
 ## explicit; go 1.19
 google.golang.org/genproto/googleapis/api
 google.golang.org/genproto/googleapis/api/annotations
-# google.golang.org/genproto/googleapis/rpc v0.0.0-20230920204549-e6e6cdab5c13
+# google.golang.org/genproto/googleapis/rpc v0.0.0-20231012201019-e917dd12ba7a
 ## explicit; go 1.19
 google.golang.org/genproto/googleapis/rpc/code
 google.golang.org/genproto/googleapis/rpc/errdetails
 google.golang.org/genproto/googleapis/rpc/status
-# google.golang.org/grpc v1.58.2
+# google.golang.org/grpc v1.58.3
 ## explicit; go 1.19
 google.golang.org/grpc
 google.golang.org/grpc/attributes
@@ -723,4 +724,4 @@ gopkg.in/warnings.v0
 # gopkg.in/yaml.v3 v3.0.1
 ## explicit
 gopkg.in/yaml.v3
-# github.com/pelletier/go-toml/v2 => github.com/dbarrosop/go-toml/v2 v2.0.0-20230603161714-891170c4bf79
+# cuelang.org/go => cuelang.org/go v0.4.3